{"id":"CVE-2026-115546","kind":"vulnerability","aliases":["CVE-2026-115546"],"related":[],"title":"Okta Access Gateway: unvalidated sign-on source can grant Admin Console access","description":"Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.","summary":"Okta Access Gateway does not check which authentication source is selected during sign-on. A user with an active session can change that parameter so that a SAML assertion grants access to the Admin Console.","severity":"high","cvss":8.1,"epss":0.0042,"exploited":false,"exploited_at":null,"products":[{"name":"Okta Access Gateway","fixed":["2026.10.2"],"affected":"< 2026.10.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["authentication-bypass","okta-access-gateway","privilege-escalation","self-hosted","sso","vendor"],"not_affected_if":["no-oag-appliance","version-2026.10.2-or-later"],"how_to_check":"Check the appliance version in the Access Gateway Management Console (or release info on the appliance). Any version before 2026.10.2 is affected. Okta publishes no log signature for abuse; review Admin Console sign-ins for SAML logins from non-admin users.","fix":"Upgrade the Okta Access Gateway appliance to 2026.10.2 or later (Okta's advisory); the latest release listed is 2026.44.0, deployed Oct 23, 2026.","status":"open","published_at":"2026-10-23T04:18:15+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:05:45+00:00","updated_at":"2026-10-25T03:15:12+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-25T03:05:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Okta Access Gateway: unvalidated sign-on source can grant Admin Console access","impact":"high","summary":"Okta Access Gateway does not check which authentication source is selected during sign-on. A user with an active session can change that parameter so that a SAML assertion grants access to the Admin Console.","category":"vendor","nicknames":[],"who_cares":["okta-access-gateway","self-hosted","sso"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker reaches Admin Console with a forged SAML assertion","analyst_note":"Find the vendor advisory and affected OAG versions and fixed builds; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115546 does not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Okta Access Gateway for sign-on. The sources do not give affected versions or whether the Admin Console path is enabled by default, so the exposure cannot be confirmed from them.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000541,"input_tokens":3324,"output_tokens":418,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected OAG versions and fixed builds; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115546 does not give them.","search":"'-115546':16A,19A '-2026':15A,18A 'access':2A,13A,21A,28B,39B,69B,75C,109C 'activ':57B,94C 'admin':11A,72B,112C 'assert':67B,107C 'authent':24B,45B,83C,90C,99C 'authentication-bypass':23B 'bypass':25B 'chang':60B 'check':43B 'consol':12A,73B,113C 'cve':14A,17A 'escal':32B 'gateway':3A,22A,29B,40B,76C 'generat':104C 'grant':10A,68B,108C 'host':35B 'may':103C 'modifi':97C 'oag':77C 'okta':1A,20A,27B,38B,74C 'okta-access-gateway':26B 'paramet':62B,101C 'privileg':31B 'privilege-escal':30B 'saml':66B,106C 'select':48B,82C 'self':34B 'self-host':33B 'session':58B,95C 'sign':6A,51B,87C 'sign-on':5A,50B,86C 'sourc':8A,46B,84C,100C 'sso':36B 'unvalid':4A 'user':54B,91C 'valid':80C 'vendor':37B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a self-hosted Okta Access Gateway appliance older than 2026.10.2. Exploitation needs a valid session for any authentication source configured on the gateway, so any ordinary gateway user could try to reach the Admin Console. Okta's cloud services are not named as affected. Teams without an OAG appliance can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:15:12Z","by":"analyst","run_id":680},"products":{"at":"2026-10-25T03:15:12Z","by":"analyst","run_id":680},"who_affected":{"at":"2026-10-25T03:15:12Z","by":"analyst","run_id":680}},"analyst_revisit_at":null,"first_public_at":"2026-10-23T04:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@okta.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115546","severity":null,"published_at":"2026-10-23T04:18:15+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115546","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115546","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115546:680","url":null,"severity":null,"published_at":"2026-10-25T03:15:12+00:00","modified_at":"2026-10-25T03:15:12+00:00","first_seen_at":"2026-10-25T03:15:12+00:00","fetched_at":"2026-10-25T03:15:12+00:00","note":"Okta advisory (Oct 22, 2026) read: OAG < 2026.10.2 affected, fixed in 2026.10.2; precondition is any valid session on any configured auth source; no workaround or exploitation stated. Release notes show later 2026.44.0 (Oct 23) as 'security enhancements' only. Sibling: CVE-2026-115547 (admin command exec) fixed in same build."}],"documents":[{"id":3080,"url":"https://trust.okta.com/security-advisories/authentication-source-verification-issue-in-okta-access-gateway-cve-2026-115546/","title":"Okta advisory: Authentication Source Verification Issue in Okta Access Gateway CVE-2026-115546","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3082,"url":"https://help.okta.com/oag/en-us/Content/Topics/ReleaseNotes/oag/oag-release-notes.htm","title":"Okta Access Gateway release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}