Okta Patches Critical Auth0 and Access Gateway Flaws

Key Takeaways

• Okta has released patches for three critical vulnerabilities impacting its Auth0 AD/LDAP Connector and Okta Access Gateway products.
• The flaws include a high-severity stored cross-site scripting (XSS), an authorization bypass, and a SQL injection vulnerability.
• The most severe issue, affecting Auth0 AD/LDAP Connector, carries a CVSS v3 score of 9.0.
• Affected organizations must prioritize upgrading to the latest versions to mitigate potential exploitation.

Okta Addresses Critical Flaws in Identity Management Products

Okta has recently rolled out crucial security updates to address a trio of vulnerabilities discovered in its Auth0 AD/LDAP Connector and Okta Access Gateway. These security weaknesses, detailed on September 8, 2026, could potentially lead to stored cross-site scripting (XSS), unauthorized access, and SQL injection, depending on specific system configurations.

Organizations leveraging these identity and access management components are strongly advised to expedite upgrades. This is particularly critical for instances where the Access Gateway secures sensitive enterprise applications or where privileged users manage Auth0 directory connectors.

High-Severity XSS in Auth0 AD/LDAP Connector

The most pressing concern among the disclosed vulnerabilities is a stored cross-site scripting flaw, tracked as CVE-2026-85982, which impacts the Auth0 AD/LDAP Connector. This vulnerability has been assigned a CVSS v3 score of 9.0, indicating its severe nature. The root cause lies in the improper HTML encoding of data from directory search results and updater log content, which is subsequently rendered within the connector’s administrative interface.

Exploitation of this vulnerability requires an attacker to possess authenticated access to a connected user directory with privileges to modify user-editable attributes. Alternatively, a local user with low-level privileges on the host running the connector could inject malicious script content into updater logs or relevant data fields. The malicious payload would then execute when an administrator views the compromised search results or update logs within the Auth0 AD/LDAP Connector Admin Panel.

Successful exploitation could compromise administrative session data, enable unauthorized actions through an administrator’s browser, or facilitate further breaches of the identity infrastructure. This issue is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). To remediate this, Okta and Auth0 users should upgrade their auth0/ad-ldap-connector to version 8.0.0 or later.

Authorization Bypass in Okta Access Gateway Protected Rules

Okta also addressed CVE-2026-78626, an authorization bypass vulnerability affecting Okta Access Gateway Protected Rules. This flaw received a CVSS v3 score of 8.1 and originates from inadequate input sanitization and regular-expression evaluation during the authorization checks performed by Protected Rules.

This vulnerability affects Okta Access Gateway versions prior to 2026.9.1. For successful exploitation, an organization must have configured a Protected Rule policy for one or more application resources. Additionally, an attacker must hold a valid, authenticated account assigned to the target application, even if it has minimal privileges. Under these specific conditions, specially crafted input could circumvent the intended authorization enforcement of the Protected Rule, allowing unauthorized access to restricted resources or functions. This issue is classified as CWE-863 (Incorrect Authorization) and has been patched in Access Gateway version 2026.9.1.

SQL Injection in Access Gateway Advanced-Mode Datastores

A third vulnerability, CVE-2026-78623, impacts Access Gateway advanced-mode datastores and has a CVSS v3 score of 7.7. This SQL injection vulnerability arises when SAML assertion attribute values are incorporated into custom database queries without proper sanitization.

Exploitation requires an Access Gateway advanced-mode database datastore configured with custom SQL queries that reference SAML assertion attributes. The attacker also needs an active authentication session capable of supplying attacker-controlled values for at least one of these referenced assertion attributes. Since these values are substituted into query strings before query preparation, malicious input could execute unintended SQL commands against the backend database. Depending on database permissions and query design, this could lead to exposure of sensitive data, alteration of records, or disruption of database availability. This flaw is categorized as CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command). Organizations should upgrade affected Okta Access Gateway appliances to version 2026.9.1 or later to mitigate this risk.

What You Should Do

• Immediately identify all deployed versions of Auth0 AD/LDAP Connector and Okta Access Gateway within your infrastructure.
• Apply the latest available updates: upgrade auth0/ad-ldap-connector to version 8.0.0 or later, and Okta Access Gateway to version 2026.9.1 or later.
• Review all Protected Rule configurations in Okta Access Gateway to ensure they are robust and correctly implemented.
• Audit any advanced datastore queries in Access Gateway that incorporate SAML attributes to verify proper sanitization.
• Examine directory attribute permissions and investigate any unusual or unauthorized changes to connector logs or user-editable directory fields.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.