CVE-2026-78626CWE-863broken-access-control

CVE-2026-78626

High · published September 9, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-09T00:18Z
Affected products (1)
ProductVersionsFixed in
okta/access_gateway< 2026.9.12026.9.1
References (1)
https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-protected-rules-cve-2026-78626 · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 20:11Z
    Improper Input Sanitization in Okta Access Gateway Protected Rules
    cvelistv5