CVE-2026-115546
CVE-2026-115546 · Authentication Source Verification Issue in Okta Access Gateway
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
CVSS 8.1 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
okta access gateway
- Versions
- ≥ 0, < 2026.10.2: Affected (custom)
Update to 2026.10.2