Okta has released security fixes for three vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. The flaws could enable stored cross-site scripting, authorization bypass, and SQL injection in certain configurations.
The vulnerabilities were disclosed on September 8, 2026. Organizations using the affected identity and access management components should prioritize upgrades, especially where Access Gateway protects sensitive enterprise applications or privileged users administer Auth0 directory connectors.
The most severe issue, tracked as CVE-2026-85982, affects the Auth0 AD/LDAP Connector. The stored cross-site scripting vulnerability received a CVSS v3 score of 9.0 and is caused by improper HTML encoding of directory search-result data and updater log content rendered in the connector’s administrative panel.
An attacker would need authenticated access to a connected user directory with permission to modify user-editable attributes. Alternatively, a low-privileged local user with access to the host running the connector could introduce malicious script content into updater logs or relevant data fields.
The payload could execute when an administrator opens the affected search results or update logs in the Auth0 AD/LDAP Connector Admin Panel.
Successful exploitation could expose administrative session data, allow unauthorized actions through an administrator’s browser session, or support further compromise of identity infrastructure.
The issue is classified as CWE-79, or improper neutralization of input during web page generation. Okta and Auth0 users should upgrade auth0/ad-ldap-connector to version 8.0.0 or later to remediate the issue.
Okta also addressed CVE-2026-78626, an authorization bypass vulnerability in Okta Access Gateway Protected Rules. The flaw has a CVSS v3 score of 8.1. It stems from improper input sanitization and regular-expression evaluation during Protected Rule authorization checks.
The vulnerability affects Okta Access Gateway releases earlier than version 2026.9.1. Exploitation requires an organization to have configured a Protected Rule policy for one or more application resources.
An attacker must also hold a valid authenticated account assigned to the target application, even if that account has only low-level privileges.
Under these conditions, specially crafted input may bypass the Protected Rule’s intended authorization enforcement. This could allow a user to access protected resources or functions that policy should have restricted. The issue is categorized as CWE-863: Incorrect Authorization. Okta has resolved the problem in Access Gateway version 2026.9.1.
A third vulnerability, CVE-2026-78623, affects Access Gateway advanced-mode datastores and carries a CVSS v3 score of 7.7. The SQL injection issue occurs when SAML assertion attribute values are interpolated into custom database queries without proper sanitization.
The affected setup requires an Access Gateway advanced-mode database datastore that uses custom SQL queries referencing SAML assertion attributes.
An attacker also needs an active authentication session that can supply attacker-controlled values for at least one referenced assertion attribute.
Because the values are substituted into query strings before query preparation, malicious input could execute unintended SQL commands against the configured backend database. Depending on database permissions and query design, this may expose sensitive data, alter records, or affect database availability.
The flaw is classified as CWE-89: Improper Neutralization of Special Elements Used in an SQL Command. Organizations should upgrade affected Okta Access Gateway appliances to version 2026.9.1 or later.
Security teams should identify deployed Auth0 AD/LDAP Connector and Okta Access Gateway versions, apply the available updates, review Protected Rule configurations, and audit advanced datastore queries that incorporate SAML attributes.
Administrators should also review directory attribute permissions and investigate unusual changes to connector logs or user-editable directory fields.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the…
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology…
CISA and five international cybersecurity agencies have released detailed guidance describing 17 common techniques hackers…
Apple has released one of its largest coordinated security rollouts, addressing 273 distinct critical vulnerabilities…
You can’t detect today's attacks with yesterday’s threat intelligence; that’s how you could briefly formulate…
Microsoft has published a draft Humanist AI Code of Conduct that would prohibit its in-house…