Okta Access Gateway contains a vulnerability due to improper handling of input sanitization and regular expression evaluation within its Protected Rule authorization mechanism. This flaw enables an authorization bypass when Protected Rule policies are configured by an administrator on application resources. The vulnerability has a CVSS 3.1 score of 8.1, indicating high severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction. No patch or official remediation guidance has been published yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker with some level of privileges to bypass authorization checks on protected application resources, potentially leading to unauthorized access and compromise of sensitive data or functionality. The vulnerability does not impact availability but has high confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should review and possibly restrict the use of Protected Rule policies in Okta Access Gateway and monitor for unusual access patterns. Follow Okta's official communications for updates on patches or workarounds.