CVEvulnerability

CVE-2026-78560

6.5 MEDIUM Published 2026-09-08 Modified 2026-09-23 Official page ↗
Status
Analyzed
Published
2026-09-08
Last modified
2026-09-23
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-287

Description

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to sanitize and enforce client headers, an unauthenticated user can supply an arbitrary identity value to initiate a session.

Affected configurations

• okta access gateway (< 2026.9.1)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References