The Okta Access Gateway includes an optional pass-through authentication source that trusts user identity information from an HTTP header supplied by the client. This header is not cryptographically validated, so if the deployment lacks an upstream reverse proxy or firewall that sanitizes and enforces client headers, an attacker can impersonate arbitrary users by supplying forged identity headers. This leads to improper authentication and unauthorized session initiation.

An unauthenticated attacker can bypass authentication controls by supplying arbitrary identity values in HTTP headers, potentially gaining unauthorized access to sessions. The impact is limited to confidentiality and integrity with no availability impact. The CVSS score of 4.8 reflects a medium severity with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that the optional pass-through authentication source is only enabled behind an upstream reverse proxy or firewall that sanitizes and enforces client headers to prevent header spoofing. Do not enable this feature in unprotected environments.