Okta has released security updates for three high-severity vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway.
These vulnerabilities could allow authenticated attackers to trigger stored cross-site scripting (XSS), bypass Protected Rule authorization controls, or execute unintended SQL commands against configured backend databases under specific deployment conditions.
All three vulnerabilities were disclosed on September 8, 2026. Organizations using the affected Auth0 connector or Okta Access Gateway should prioritize upgrading, especially if they use directory attributes, Protected Rules, or custom SQL-backed advanced datastores.
Critical Stored XSS in Auth0 Connector
The most severe issue, tracked as CVE-2026-85982, affects the Auth0 AD/LDAP Connector versions before 8.0.0. Okta has assigned this vulnerability a CVSS v3 score of 9.0, categorizing it as critical.
This flaw is a stored cross-site scripting vulnerability caused by improper HTML encoding of data rendered in search results and updater logs within the Auth0 AD/LDAP Connector Admin Panel. It is classified as CWE-79, Improper Neutralization of Input During Web Page Generation.
An attacker with authenticated access to a connected user directory and permission to modify user-editable directory attributes could inject malicious script content into those fields. Alternatively, a low-privileged local user on the system hosting the connector could introduce malicious content into the updater log data.
The payload executes when an administrator opens affected directory search results or update logs in the connector’s administrative interface. Successful exploitation could enable session theft, unauthorized administrative actions via the victim’s browser, interface manipulation, or access to sensitive data visible to the administrator.
Okta recommends upgrading the auth0/ad-ldap-connector package to version 8.0.0 or later to remediate CVE-2026-85982.
Okta has also addressed CVE-2026-78626, an authorization-bypass issue in Okta Access Gateway versions before 2026.9.1. This vulnerability has a CVSS v3 score of 8.1 and is categorized as CWE-863, which denotes Incorrect Authorization.
This flaw arises from improper input sanitization and regular expression evaluation in the product’s Protected Rule authorization check. Protected Rules enforce access restrictions on specified application resources.
Exploitation of this vulnerability requires that an administrator has configured a Protected Rule policy for one or more resources, and the attacker must have a valid authenticated account assigned to the target application.
According to Okta, an attacker at any application privilege level may be able to bypass the configured authorization control.
This issue is particularly concerning for organizations using Access Gateway to enforce granular, resource-level protections for legacy or on-premises applications.
Administrators should review whether Protected Rules protect sensitive paths, administrative panels, or high-value application functions and then update affected gateways to version 2026.9.1 or later.
The third flaw, CVE-2026-78623, is an SQL injection vulnerability in the advanced-mode datastore configuration of Okta Access Gateway. It carries a CVSS v3 score of 7.7 and maps to CWE-89, which represents Improper Neutralization of Special Elements used in an SQL Command.
The issue arises because Access Gateway does not sanitize SAML assertion values before inserting them into custom database query strings. Although the query is prepared afterward, attacker-controlled assertion values are interpolated before that preparation, potentially allowing unintended SQL execution against the configured backend database.
To exploit this vulnerability, an advanced-mode database datastore with custom SQL queries referencing SAML assertion attributes is required. The attacker must also have an active authentication session with controllable values for at least one referenced assertion attribute.
Organizations should upgrade Access Gateway appliances to version 2026.9.1 or later. Security teams should also audit custom SQL datastore queries, identify SAML attributes used as query inputs, and restrict assertion values to tightly validated formats wherever possible.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
