Okta Patches Critical Flaws in Auth0 and Access Gateway, Addressing XSS, Auth Bypass, and SQLi

Okta has issued critical security patches for three vulnerabilities affecting its Auth0 AD/LDAP Connector and Okta Access Gateway. These flaws, disclosed on September 8, 2026, could allow attackers to execute stored cross-site scripting (XSS), bypass authorization controls, and perform SQL injection attacks, depending on the specific configuration and components in use.

The most severe of these vulnerabilities, CVE-2026-85982, is a stored XSS flaw within the Auth0 AD/LDAP Connector. With a CVSS v3 score of 9.0, this vulnerability arises from improper HTML encoding of data within the connector's administrative panel. Attackers could exploit this by gaining authenticated access to a connected user directory and modifying user-editable attributes, or by introducing malicious script content into updater logs or data fields on the connector's host. When an administrator views the affected search results or logs, the malicious script would execute, potentially leading to the exposure of administrative session data or unauthorized actions.

To mitigate CVE-2026-85982, Okta strongly recommends upgrading the Auth0 AD/LDAP Connector to version 8.0.0 or later. This update addresses the improper neutralization of input during web page generation (CWE-79) that allowed for the XSS exploitation. Organizations relying on this connector for managing their identity infrastructure should prioritize this update to prevent potential compromise of administrative privileges.

Another significant vulnerability, CVE-2026-78626, is an authorization bypass flaw in Okta Access Gateway Protected Rules, carrying a CVSS v3 score of 8.1. This issue stems from inadequate input sanitization and regular-expression evaluation within the Protected Rule authorization checks. Exploitation requires an attacker to possess a valid authenticated account for a target application protected by these rules, even if it's a low-privilege account. By crafting specific input, an attacker could bypass the intended authorization enforcement, gaining access to protected resources or functions that should have been restricted.

Okta has resolved CVE-2026-78626 in Okta Access Gateway version 2026.9.1. This fix addresses the incorrect authorization (CWE-863) that allowed unauthorized access. Companies using Okta Access Gateway to secure sensitive enterprise applications should ensure they are running version 2026.9.1 or newer.

The third vulnerability, CVE-2026-78623, affects Okta Access Gateway's advanced-mode datastores, with a CVSS v3 score of 7.7. This SQL injection flaw occurs when SAML assertion attribute values are directly interpolated into custom database queries without proper sanitization. An attacker with an active authentication session can supply malicious values for assertion attributes, which are then used in database queries. This can lead to the execution of unintended SQL commands, potentially exposing sensitive data, corrupting records, or impacting database availability.

This SQL injection vulnerability (CWE-89) is remediated by upgrading Okta Access Gateway appliances to version 2026.9.1 or later. Security teams are advised to review their configurations, apply the necessary updates, and audit custom SQL queries that reference SAML attributes to prevent data breaches or system compromise.

In response to these disclosures, Okta urges all affected customers to identify their deployed versions of the Auth0 AD/LDAP Connector and Okta Access Gateway. Promptly applying the available updates is crucial. Furthermore, organizations should review their Protected Rule configurations and audit any advanced datastore queries that incorporate SAML attributes. Administrators should also examine directory attribute permissions and investigate any unusual activity in connector logs or user-editable directory fields to ensure their identity and access management systems remain secure.