CVE-2026-78560
Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source
- State
- Published
- Severity
- 4.8 Medium
- Published
- Sep 8, 2026
- Updated
- Sep 10, 2026
- Reserved
- Aug 24, 2026
Description
The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to sanitize and enforce client headers, an unauthenticated user can supply an arbitrary identity value to initiate a session.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.8 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | Okta |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
Okta Access GatewayOkta |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.