Okta has released security fixes for three vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. The flaws could enable stored cross-site scripting, authorization bypass, and SQL injection in certain configurations.
The vulnerabilities were disclosed on September 8, 2026. Organizations using the affected identity and access management components should prioritize upgrades, especially where Access Gateway protects sensitive enterprise applications or privileged users administer Auth0 directory connectors.
The most severe issue, tracked as CVE-2026-85982, affects the Auth0 AD/LDAP Connector. The stored cross-site scripting vulnerability received a CVSS v3 score of 9.0 and is caused by improper HTML encoding of directory search-result data and updater log content rendered in the connector’s administrative panel.
An attacker would need authenticated access to a connected user directory with permission to modify user-editable attributes. Alternatively, a low-privileged local user with access to the host running the connector could introduce malicious script content into updater logs or relevant data fields.
The payload could execute when an administrator opens the affected search results or update logs in the Auth0 AD/LDAP Connector Admin Panel.
Okta Fixes Auth0 and Access Gateway Flaws
Successful exploitation could expose administrative session data, allow unauthorized actions through an administrator’s browser session, or support further compromise of identity infrastructure.
The issue is classified as CWE-79, or improper neutralization of input during web page generation. Okta and Auth0 users should upgrade auth0/ad-ldap-connector to version 8.0.0 or later to remediate the issue.
Okta also addressed CVE-2026-78626, an authorization bypass vulnerability in Okta Access Gateway Protected Rules. The flaw has a CVSS v3 score of 8.1. It stems from improper input sanitization and regular-expression evaluation during Protected Rule authorization checks.
The vulnerability affects Okta Access Gateway releases earlier than version 2026.9.1. Exploitation requires an organization to have configured a Protected Rule policy for one or more application resources.
An attacker must also hold a valid authenticated account assigned to the target application, even if that account has only low-level privileges.
Under these conditions, specially crafted input may bypass the Protected Rule’s intended authorization enforcement. This could allow a user to access protected resources or functions that policy should have restricted. The issue is categorized as CWE-863: Incorrect Authorization. Okta has resolved the problem in Access Gateway version 2026.9.1.
A third vulnerability, CVE-2026-78623, affects Access Gateway advanced-mode datastores and carries a CVSS v3 score of 7.7. The SQL injection issue occurs when SAML assertion attribute values are interpolated into custom database queries without proper sanitization.
The affected setup requires an Access Gateway advanced-mode database datastore that uses custom SQL queries referencing SAML assertion attributes.
An attacker also needs an active authentication session that can supply attacker-controlled values for at least one referenced assertion attribute.
Because the values are substituted into query strings before query preparation, malicious input could execute unintended SQL commands against the configured backend database. Depending on database permissions and query design, this may expose sensitive data, alter records, or affect database availability.
The flaw is classified as CWE-89: Improper Neutralization of Special Elements Used in an SQL Command. Organizations should upgrade affected Okta Access Gateway appliances to version 2026.9.1 or later.
Security teams should identify deployed Auth0 AD/LDAP Connector and Okta Access Gateway versions, apply the available updates, review Protected Rule configurations, and audit advanced datastore queries that incorporate SAML attributes.
Administrators should also review directory attribute permissions and investigate unusual changes to connector logs or user-editable directory fields.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Okta Fixes Auth0 and Access Gateway Flaws Enabling XSS, Auth Bypass, and SQL Injection appeared first on Cyber Security News.