AI analysis
Okta Access Gateway (OAG), the gateway component Okta customers deploy to extend single sign-on to on-premises or private applications, mishandles input sanitization and regular expression evaluation in its Protected Rule authorization check, an incorrect-authorization flaw (CWE-863). The bypass is triggered only when an administrator has explicitly configured a Protected Rule policy on one or more application resources; an authenticated user with low-level privileges can then submit input that evades the rule's regular-expression matching and reach resources the policy was meant to restrict. A successful bypass yields high confidentiality and integrity impact (unauthorized read and potentially modification of protected application resources) with no availability impact, per the CVSS 8.1 score (network vector, low privileges required, no user interaction). Only organizations running Okta Access Gateway that use Protected Rule policies are affected; OAG deployments without any Protected Rule configuration are not exposed. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 0.2% probability of exploitation within 30 days (12th percentile), indicating no known exploitation at this time.
What to do: Inventory your Okta Access Gateway configuration to determine whether any application resources use Protected Rule policies; if none do, you are not affected by this bypass. If Protected Rules are in use, consult Okta's security advisory (trust.okta.com) for the patched OAG release and upgrade promptly, then review gateway access logs for requests that reached protected resources without satisfying the rule. Until patching is complete, consider compensating access controls at the application layer and continue monitoring for anomalous access to the affected resources.
Estimated exposure
nichelikely hundreds to a few thousand enterprise gateway deployments, and only the subset of those with Protected Rule policies configured — Okta Access Gateway is an enterprise add-on adopted by a minority of Okta's enterprise customer base for hybrid/on-premises application access, and only tenants that explicitly configured Protected Rule policies are exposed, implying…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.