Okta Access Gateway: Authentication bypass via unvalidated authentication source
Summary
Okta Access Gateway (OAG), an on-premises appliance, does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify this parameter, which may produce a SAML assertion granting access to the Admin Console. The attacker needs a valid session on any authentication source configured on the gateway.
Affected
- Okta Access Gateway versions prior to 2026.10.2
Fixed in
- Fixed in Okta Access Gateway 2026.10.2
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total
- Not listed in CISA KEV according to secondary sources; the CISA catalog was not checked directly
- No public proof of concept found
- EPSS 0.0042 (vulners)
Our recommendation
- Upgrade Okta Access Gateway to version 2026.10.2 or later
- Confirm the fix version for the separate PHP runtime issue (PHP2Shell) with Okta before choosing the target version
- Review accounts with gateway access and restrict Admin Console access to a management network
- Check admin logins for unexpected SAML sessions
- Prioritise CVE-2026-115547 (CVSS 9.1), which is fixed in the same release
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Okta security advisory CVE-2026-115546 trust.okta.com
- Okta security advisories trust.okta.com
- VulDB CVE-2026-115546 vuldb.com
- Strix CVE-2026-115546 www.strix.ai
- VulnCheck/vulners enrichment CVE-2026-115546 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:03.
Original description (NVD)
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.