CVE-2026-78560: Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source
The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to sanitize and enforce client headers, an unauthenticated user can supply an arbitrary identity value to initiate a session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Okta Access Gateway applianceto a version that resolves this vulnerability.Fixed in 2026.9.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Exposure is limited to Okta Access Gateway deployments where the optional pass-through authentication source is enabled and there is no upstream reverse proxy or firewall sanitizing and enforcing the client identity headers.
What does an attacker need to exploit this issue?
An attacker does not need prior authentication or user interaction. They need to be able to send requests to the affected gateway and supply an arbitrary identity value in the client-controlled HTTP header accepted by the pass-through source.
Are default configurations affected?
The issue depends on enabling the optional pass-through authentication source. The provided information does not state whether that source is enabled by default.
What can be done if patching is not immediately possible?
Place an upstream reverse proxy or firewall in front of the gateway and configure it to sanitize and enforce the client headers used for pass-through identity. This prevents clients from submitting arbitrary identity values directly.