Live › vulnerability › CVE-2026-115546
Go to dashboardOkta Access Gateway does not check which authentication source is selected during sign-on. A user with an active session can change that parameter so that a SAML assertion grants access to the Admin Console.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running a self-hosted Okta Access Gateway appliance older than 2026.10.2. Exploitation needs a valid session for any authentication source configured on the gateway, so any ordinary gateway user could try to reach the Admin Console. Okta's cloud services are not named as affected. Teams without an OAG appliance can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Okta Access Gateway | vendor | < 2026.10.2 | 2026.10.2 |
2026.10.2 is affectedUpgrade the Okta Access Gateway appliance to 2026.10.2 or later (Okta's advisory); the latest release listed is 2026.44.0, deployed Oct 23, 2026.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
This page as .md · .json · in your agent: get_signal("CVE-2026-115546")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.