ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Organization

Okta

3 mentions in 7 days · 4 in 30 days · 4 total · first seen · last

Search everything

Timeline

Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection

Okta patches three high-severity flaws in Auth0 AD/LDAP Connector and Access Gateway: stored XSS, auth bypass, SQL injection.

Okta disclosed on September 8, 2026 three vulnerabilities: CVE-2026-85982, a CVSS 9.0 stored XSS in Auth0 AD/LDAP Connector before 8.0.0; CVE-2026-78626, a CVSS 8.1 Protected Rule authorization bypass in Access Gateway before 2026.9.1; and CVE-2026-78623, a CVSS 7.7 SQL injection in Access Gateway advanced-mode datastores. Exploitation requires authenticated access and specific configurations. Fixes require upgrading the connector to 8.0.0+ and Access Gateway to 2026.9.1+.

GBHackers · 4d agoVulnerability 2 sourcesCVE-2026-85982CVE-2026-78626CVE-2026-786231

Okta Fixes Auth0 and Access Gateway Flaws Enabling XSS, Auth Bypass, and SQL Injection

Okta patched three flaws in Auth0 AD/LDAP Connector and Access Gateway, including a CVSS 9.0 stored XSS tracked as CVE-2026-85982.

Okta disclosed and patched three vulnerabilities on September 8, 2026 affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. CVE-2026-85982 is a CVSS 9.0 stored XSS in the connector's admin panel caused by improper HTML encoding of directory search results and updater logs; CVE-2026-78626 is a CVSS 8.1 authorization bypass in Access Gateway Protected Rules; CVE-2026-78623 is a CVSS 7.7 SQL injection in advanced-mode datastores via unsanitized SAML assertion attributes. Fixes ship in connector version 8.0.0 and Access Gateway 2026.9.1; no exploitation has been reported.

Cyber Security Newsupdated · 4d agofirst · 4d agoVulnerability 2 sourcesCVE-2026-85982CVE-2026-78626CVE-2026-786231

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.

Okta analyzed a 7 GB infostealer dump from August 2, 2026 covering 5,871 infected machines in 162 countries and found 555 of 44,791 JWTs related to AI services, plus 1,843 unexpired JWTs and JWEs (largely set by OpenAI via NextAuth.js) and 24 still-valid API keys for Google Gemini, OpenAI, Groq and OpenRouter. Valid session tokens and API keys can be replayed with anti-detect browsers like Camoufox to bypass credential and MFA checks, fueling an underground market for AI account access known as LLMjacking, where attackers rack up victims' AI compute bills. Some 17.7% of the JWTs contained plaintext PII usable for social engineering. Google's GTIG reported growing buyer demand for Claude, Gemini, Cursor and Devin credentials, and Mandiant handled an incident where an actor used an exposed GitHub PAT to deploy unauthorized AI infrastructure and scale high-performance compute.

The Hacker Newsupdated · 5d agofirst · 6d agoThreat actor in the wild 4 sources1

Hunting Vulnerabilities Using Frontier Models

Okta used frontier AI models GPT-5.5 Cyber and Mythos via OpenAI and Anthropic programs to scan millions of code lines for vulnerabilities.

Okta describes using frontier AI models, including GPT-5.5 Cyber Preview (TAC) and Mythos Preview, through OpenAI's Daybreak Cyber Partner Program and Anthropic's Project Glasswing to hunt vulnerabilities across its product codebase. The team built a custom Python orchestrator with strong isolation, vendor-agnostic model support, and four distinct scanning pipelines executed as isolated Codex or Claude Code sessions with progressive context loading to reduce context bloat. Human experts and AI agents worked both autonomously and in paired hunts, and Okta reports the best results when humans and agents taught each other.

Okta Security · 7d agoResearch

Related CVEs

  • CVE-2026-859829.0<1%
    Stored XSS in Auth0 AD/LDAP Connector Admin Panel
    The Auth0 AD/LDAP Connector fails to properly HTML-encode directory data shown in search results and updater log content within its admin panel, allowing stored Cross-Site Scripting (CWE-79). An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector runs, can insert script content that is later rendered to an administrator. When an administrator views the affected search results or update logs, the injected script executes in the admin's browser, enabling session-context actions with high confidentiality, integrity, and availability impact per the CVSS scope-changed rating (9.0, critical). Only organizations running the self-hosted Auth0 AD/LDAP Connector to federate on-premises Active Directory/LDAP with Auth0 are affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days, so no active exploitation is currently known.
    · Okta (Auth0) Auth0 AD/LDAP Connectormoderate
  • CVE-2026-786268.1<1%
    Authorization Bypass in Okta Access Gateway Protected Rule Checks
    Okta Access Gateway (OAG), the gateway component Okta customers deploy to extend single sign-on to on-premises or private applications, mishandles input sanitization and regular expression evaluation in its Protected Rule authorization check, an incorrect-authorization flaw (CWE-863). The bypass is triggered only when an administrator has explicitly configured a Protected Rule policy on one or more application resources; an authenticated user with low-level privileges can then submit input that evades the rule's regular-expression matching and reach resources the policy was meant to restrict. A successful bypass yields high confidentiality and integrity impact (unauthorized read and potentially modification of protected application resources) with no availability impact, per the CVSS 8.1 score (network vector, low privileges required, no user interaction). Only organizations running Okta Access Gateway that use Protected Rule policies are affected; OAG deployments without any Protected Rule configuration are not exposed. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 0.2% probability of exploitation within 30 days (12th percentile), indicating no known exploitation at this time.
    · Okta Access Gatewayniche
  • CVE-2026-786237.7<1%
    SQL Injection in Okta Access Gateway via Unsanitized SAML Assertion Values
    Okta Access Gateway (CVE-2026-78623, CWE-89) fails to sanitize SAML assertion values before they are interpolated into database queries when the datastore is configured in advanced mode. Because the unsanitized values are substituted directly into the query string prior to statement preparation, an attacker whose crafted SAML assertion is processed by the gateway can cause unintended SQL execution against the configured backend database. Successful exploitation yields a high-confidentiality impact (exposure of backend database data) with limited integrity and availability impact, and the changed-scope score (S:C) means the backend database can be affected beyond the gateway component. Organizations running Okta Access Gateway with an advanced-mode datastore backed by a SQL database are affected; no specific affected version range is provided in the available data. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within 30 days.
    · Okta Access Gatewaymoderate

Appears with

vendor Okta 4product Auth0 AD/LDAP Connector 2vendor Auth0 2organization Anthropic 2product Okta Access Gateway 2organization OpenAI 2ai model Devin 1ai model Gemini 1ai model GPT-5.5 Cyber Preview 1ai model Mythos Preview 1organization Google Threat Intelligence Group 1organization Mandiant 1product Camoufox 1product Claude Code 1product Codex 1product Cursor 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.