CVE-2026-78560: Improper Authentication in Okta Okta Access Gateway

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In deployments where this optional source is enabled without an upstream reverse proxy or firewall configured to sanitize and enforce client headers, an unauthenticated attacker can supply an arbitrary identity value to initiate a session, potentially bypassing authentication controls. The vulnerability affects versions from 0 up to but not including 2026.9.1. The CVSS 3.1 base score is 4.8, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

An unauthenticated attacker can supply arbitrary identity information via HTTP headers to initiate a session, potentially bypassing authentication mechanisms if the optional pass-through authentication source is enabled without proper upstream header validation. This could lead to unauthorized access with limited confidentiality and integrity impact. There is no indication of availability impact or known exploits in the wild.

Upgrade Okta Access Gateway to version 2026.9.1 or later where this issue is fixed. Additionally, ensure that if the optional pass-through authentication source is enabled, an upstream reverse proxy or firewall is configured to sanitize and enforce client headers to prevent arbitrary identity injection. Patch status is confirmed by the affectedVersions field indicating fixed in 2026.9.1.