The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade Okta Access Gateway to version 2026.9.1 or greater.
Workaround
No workaround given by the vendor.
References
History
Tue, 08 Sep 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources. | |
| Title | Improper Input Sanitization in Okta Access Gateway Protected Rules | |
| Weaknesses | CWE-863 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Okta
Published:
Updated: 2026-09-08T20:11:08.024Z
Reserved: 2026-08-24T22:04:00.475Z
Link: CVE-2026-78626
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-09-08T20:18:38.070
Modified: 2026-09-08T21:13:32.293
Link: CVE-2026-78626
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses