CVE-2026-78626: Incorrect Authorization in Okta Okta Access Gateway

Okta Access Gateway contains an authorization bypass vulnerability due to improper handling of input sanitization and regular expression evaluation within its Protected Rule authorization check. When administrators configure Protected Rule policies on application resources, this flaw can be exploited to bypass intended authorization controls. The vulnerability affects versions from 0 up to but not including 2026.9.1. It has a CVSS 3.1 score of 8.1, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and high confidentiality and integrity impact.

Successful exploitation of this vulnerability allows an attacker with some privileges to bypass authorization controls on protected application resources, potentially leading to unauthorized access and compromise of sensitive data. The confidentiality and integrity of the affected systems can be severely impacted, but availability is not affected.

A fix is available in Okta Access Gateway version 2026.9.1 and later. Users should upgrade to this version or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the patch. No additional vendor advisory content was provided; therefore, check Okta's official advisory for the latest remediation guidance.