CVE-2026-78626

Okta Access Gateway (OAG), the gateway component Okta customers deploy to extend single sign-on to on-premises or private applications, mishandles input sanitization and regular expression evaluation in its Protected Rule authorization check, an incorrect-authorization flaw (CWE-863). The bypass is triggered only when an administrator has explicitly configured a Protected Rule policy on one or more application resources; an authenticated user with low-level privileges can then submit input that evades the rule's regular-expression matching and reach resources the policy was meant to restrict. A successful bypass yields high confidentiality and integrity impact (unauthorized read and potentially modification of protected application resources) with no availability impact, per the CVSS 8.1 score (network vector, low privileges required, no user interaction). Only organizations running Okta Access Gateway that use Protected Rule policies are affected; OAG deployments without any Protected Rule configuration are not exposed. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 0.2% probability of exploitation within 30 days (12th percentile), indicating no known exploitation at this time.

What to do: Inventory your Okta Access Gateway configuration to determine whether any application resources use Protected Rule policies; if none do, you are not affected by this bypass. If Protected Rules are in use, consult Okta's security advisory (trust.okta.com) for the patched OAG release and upgrade promptly, then review gateway access logs for requests that reached protected resources without satisfying the rule. Until patching is complete, consider compensating access controls at the application layer and continue monitoring for anomalous access to the affected resources.