Okta Fixes Auth0 and Access Gateway Flaws Enabling XSS, Auth Bypass, and SQL Injection
Okta patched three flaws in Auth0 AD/LDAP Connector and Access Gateway, including a CVSS 9.0 stored XSS tracked as CVE-2026-85982.
Okta disclosed and patched three vulnerabilities on September 8, 2026 affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. CVE-2026-85982 is a CVSS 9.0 stored XSS in the connector's admin panel caused by improper HTML encoding of directory search results and updater logs; CVE-2026-78626 is a CVSS 8.1 authorization bypass in Access Gateway Protected Rules; CVE-2026-78623 is a CVSS 7.7 SQL injection in advanced-mode datastores via unsanitized SAML assertion attributes. Fixes ship in connector version 8.0.0 and Access Gateway 2026.9.1; no exploitation has been reported.
- CVE-2026-85982 stored XSS (CVSS 9.0) fixed in auth0/ad-ldap-connector 8.0.0
- CVE-2026-78626 authorization bypass (CVSS 8.1) in Access Gateway Protected Rules
- CVE-2026-78623 SQL injection (CVSS 7.7) in advanced-mode datastores via SAML attributes
- Exploitation requires authenticated access or specific Protected Rule/datastore configurations
- No reports of in-the-wild exploitation; upgrades to Access Gateway 2026.9.1 required
- Organizations
- Okta
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-78623+1 related CVE | SQL Injection in Okta Access Gateway via Unsanitized SAML Assertion Values | 9.9 group max | <1% | ||
| CVE-2026-85982 | Stored XSS in Auth0 AD/LDAP Connector Admin Panel | 9.0 | <1% |
From the original article
3 min read at cybersecuritynews.com
Okta has released security fixes for three vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. The flaws could enable stored cross-site scripting, authorization bypass, and SQL injection in certain configurations. The vulnerabilities were disclosed on September 8, 2026.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.