CVE-2026-78625: Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Okta Access Gatewayto a version that resolves this vulnerability.Fixed in 2026.9.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires high privileges and local access. It does not require user interaction.
What privileges would injected code run with?
Injected code executes with the privileges of the web server process, because the generated PHP configuration file is automatically included during authentication requests.
Which configuration data is relevant to exposure?
Dashboard application label values are the affected input. The issue occurs when those labels are written into generated PHP configuration files without sanitization.