AI analysis
Okta Access Gateway (CVE-2026-78623, CWE-89) fails to sanitize SAML assertion values before they are interpolated into database queries when the datastore is configured in advanced mode. Because the unsanitized values are substituted directly into the query string prior to statement preparation, an attacker whose crafted SAML assertion is processed by the gateway can cause unintended SQL execution against the configured backend database. Successful exploitation yields a high-confidentiality impact (exposure of backend database data) with limited integrity and availability impact, and the changed-scope score (S:C) means the backend database can be affected beyond the gateway component. Organizations running Okta Access Gateway with an advanced-mode datastore backed by a SQL database are affected; no specific affected version range is provided in the available data. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within 30 days.
What to do: Check whether your Access Gateway datastore is configured in advanced mode against a SQL backend; if so, apply the remediation version or mitigation specified in Okta's security advisory, since no fixed version is stated in the available data. Review the backend database's query logs for anomalous or malformed SQL and constrain which SAML assertion attributes are passed into datastore queries. Because exploitation requires crafted assertion values with low-privilege access, also validate that assertion attribute values follow expected formats as an interim hardening measure.
Estimated exposure
moderate≈1,000–10,000 deployed Access Gateway instances worldwide (order-of-magnitude estimate) — No public install counts exist for this product; Access Gateway is an optional on-premises connector used by a subset of Okta's enterprise customer base to reach legacy applications, typically deployed as one or a few appliances per…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.