The Okta Access Gateway improperly controls the generation of code by failing to sanitize dashboard label values before embedding them into PHP configuration files. These generated files are automatically included during authentication requests, which leads to the execution of attacker-controlled code with the privileges of the web server process. The vulnerability has a CVSS 3.1 score of 6.7, with attack vector local, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows an attacker with high privileges on the local system to execute arbitrary code with the privileges of the web server process. This can lead to full compromise of the web server environment, including unauthorized access to sensitive data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Okta Access Gateway system to trusted administrators only and monitor for suspicious activity related to configuration file modifications.