CVE-2026-115546: Authentication Source Verification Issue in Okta Access Gateway

Published Oct 23, 2026

Updated

Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.

Affected Software

1 affected component

Okta Access Gateway

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Okta Access Gateway to a version that resolves this vulnerability.
Fixed in 2026.10.2

Event History

Oct 23, 2026

CVE Published

via MITRE·03:06 AM

Data Sourced

via MITRE·03:06 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need before attempting exploitation?

The issue requires an authenticated user with an active session. The user can modify the authentication source parameter during sign-on.

What is the potential outcome of successful exploitation?

Manipulating the parameter may cause Okta Access Gateway to generate a SAML assertion that grants access to the Admin Console.