Executive Summary
A vulnerability in Okta Access Gateway (OAG) allows an authenticated user with an active session to modify the authentication source parameter during sign-on, potentially generating a SAML assertion granting access to the Admin Console. This issue has a CVSS score of 8.1 and is classified as HIGH severity. Affected versions are prior to 2026.10.2.
Technical Analysis
The vulnerability class is an authentication bypass issue, specifically a CWE-287 (Improper Authentication) and CWE-639 (Authorization Bypass Through User-Controlled Key). The attack vector is network-based (AV:N), with high attack complexity (AC:H), no privileges required (PR:N), and no user interaction needed (UI:N). The vulnerability allows an attacker to impact confidentiality, integrity, and availability (C:H/I:H/A:H).
How It Gets Exploited
An authenticated user with an active session can modify the authentication source parameter during sign-on. By doing so, they may generate a SAML assertion that grants access to the Admin Console. The attacker would need to have an active session and the ability to modify the authentication source parameter. The technical trigger involves manipulating the authentication source parameter in a way that bypasses validation, potentially leading to unauthorized access to the Admin Console.
Impact Assessment
The vulnerability affects Okta Access Gateway (OAG) versions prior to 2026.10.2. An attacker could achieve unauthorized access to the Admin Console, potentially leading to high impact on confidentiality, integrity, and availability. The CVSS score of 8.1 indicates a high severity level.
Recommended Actions
To mitigate this vulnerability, update Okta Access Gateway (OAG) to version 2026.10.2 or later. Additionally, monitor authentication logs for suspicious activity and implement additional security measures to detect and prevent unauthorized access to the Admin Console.
Sources
- National Vulnerability Database (NVD)
- Okta Security Advisories