CVE-2026-78626 — Improper Input Sanitization in Okta Access Gateway Protected Rules

CVE-2026-78626

Improper Input Sanitization in Okta Access Gateway Protected Rules PUBLISHED

Description (CNA)

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.

Affected (CNA)

Vendor / product	Versions
Okta / Okta Access Gateway	affected 0 before 2026.9.1

CWE

CWE-863

References

https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-protected-rules-cve-2026-78626

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.