---
id: "CVE-2026-115546"
kind: "vulnerability"
aliases: ["CVE-2026-115546"]
title: "Okta Access Gateway: unvalidated sign-on source can grant Admin Console access"
severity: "high"
cvss: 8.1
epss: 0.0042
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Okta Access Gateway", "fixed": ["2026.10.2"], "affected": "< 2026.10.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authentication-bypass", "okta-access-gateway", "privilege-escalation", "self-hosted", "sso", "vendor"]
not_affected_if: ["no-oag-appliance", "version-2026.10.2-or-later"]
published_at: "2026-10-23T04:18:15+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:15:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115546", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115546", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:15:12+00:00"}]
---

# Okta Access Gateway: unvalidated sign-on source can grant Admin Console access

Okta Access Gateway does not check which authentication source is selected during sign-on. A user with an active session can change that parameter so that a SAML assertion grants access to the Admin Console.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Okta Access Gateway affected < 2026.10.2 fixed 2026.10.2

## How to check

Check the appliance version in the Access Gateway Management Console (or release info on the appliance). Any version before 2026.10.2 is affected. Okta publishes no log signature for abuse; review Admin Console sign-ins for SAML logins from non-admin users.

## Fix

Upgrade the Okta Access Gateway appliance to 2026.10.2 or later (Okta's advisory); the latest release listed is 2026.44.0, deployed Oct 23, 2026.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115546
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115546
- 2026-10-25T03:15:12+00:00 analyst — Okta advisory (Oct 22, 2026) read: OAG < 2026.10.2 affected, fixed in 2026.10.2; precondition is any valid session on any configured auth source; no workaround or exploitation stated. Release notes show later 2026.44.0 (Oct 23) as 'security enhancements' only. Sibling: CVE-2026-115547 (admin command exec) fixed in same build.

## Documents

- [advisory] Okta advisory: Authentication Source Verification Issue in Okta Access Gateway CVE-2026-115546 https://trust.okta.com/security-advisories/authentication-source-verification-issue-in-okta-access-gateway-cve-2026-115546/
- [fix] Okta Access Gateway release notes https://help.okta.com/oag/en-us/Content/Topics/ReleaseNotes/oag/oag-release-notes.htm

## From the sources

Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_