Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection
Okta patches three high-severity flaws in Auth0 AD/LDAP Connector and Access Gateway: stored XSS, auth bypass, SQL injection.
Okta disclosed on September 8, 2026 three vulnerabilities: CVE-2026-85982, a CVSS 9.0 stored XSS in Auth0 AD/LDAP Connector before 8.0.0; CVE-2026-78626, a CVSS 8.1 Protected Rule authorization bypass in Access Gateway before 2026.9.1; and CVE-2026-78623, a CVSS 7.7 SQL injection in Access Gateway advanced-mode datastores. Exploitation requires authenticated access and specific configurations. Fixes require upgrading the connector to 8.0.0+ and Access Gateway to 2026.9.1+.
- CVE-2026-85982 (CVSS 9.0) allows stored XSS via directory attributes or updater logs
- CVE-2026-78626 (CVSS 8.1) bypasses Protected Rule authorization in Access Gateway
- CVE-2026-78623 (CVSS 7.7) enables SQL injection via unsanitized SAML assertion values
- Exploitation requires authenticated access and specific Protected Rule or datastore configurations
- Admins urged to upgrade and audit SQL datastore queries and assertion validation
- Organizations
- Okta
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-78623+1 related CVE | SQL Injection in Okta Access Gateway via Unsanitized SAML Assertion Values | 9.9 group max | <1% | ||
| CVE-2026-85982 | Stored XSS in Auth0 AD/LDAP Connector Admin Panel | 9.0 | <1% |
From the original article
3 min read at gbhackers.com
Okta has released security updates for three high-severity vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. These vulnerabilities could allow authenticated attackers to trigger stored cross-site scripting (XSS), bypass Protected Rule authorization controls, or execute unintended SQL commands against configured backend databases under specific deployment conditions.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.