CVEvulnerability

CVE-2026-78625

6.7 MEDIUM Published 2026-09-08 Modified 2026-09-22 Official page ↗

Status: Analyzed
Published: 2026-09-08
Last modified: 2026-09-22
Assigner: [email protected]
CVSS 3.1 ([email protected]): 6.7 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-94

Description

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.

Affected configurations

• okta access gateway (< 2026.9.1)

Weakness · CWE (1)

CWE-94 Improper Control of Generation of Code weakness

References

https://trust.okta.com/security-advisories/insufficient-validation-of-dashboard-application-labels-in-okta-access-gateway-dashboard-site-configuration-cve-2026-78625 Vendor Advisory

CVE-2026-78625

Description

Affected configurations

Related

Weakness · CWE (1)

References