CVE-2026-78623 — Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores

CVE-2026-78623

Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores PUBLISHED

Description (CNA)

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.

Affected (CNA)

Vendor / product	Versions
Okta / Okta Access Gateway	affected 0 before 2026.9.1

CWE

CWE-89

References

https://trust.okta.com/security-advisories/improper-handling-of-saml-assertion-attributes-in-okta-access-gateway-advanced-mode-datastores-cve-2026-78623

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.