Okta has released security updates addressing three vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway, flaws that could potentially allow attackers to execute cross-site scripting attacks, bypass authorization controls, or perform SQL injection under specific conditions.
Disclosed on September 8, 2026, the vulnerabilities impact key identity and access management components used by organizations to authenticate users and secure access to enterprise applications. Security teams are encouraged to prioritize remediation efforts, particularly in environments where Access Gateway protects sensitive business systems or administrators manage Auth0 directory integrations.
Critical Auth0 Vulnerability Enables Stored Cross-Site Scripting
The most severe issue, tracked as CVE-2026-85982, affects the Auth0 AD/LDAP Connector and carries a CVSS score of 9.0.
The vulnerability stems from improper HTML encoding of directory search results and updater log data displayed within the connector's administrative interface. As a result, malicious script content could be stored and later executed when viewed by an administrator.
To exploit the flaw, an attacker must have authenticated access to a connected directory and permission to modify user-editable attributes. Alternatively, a low-privileged user with access to the host running the connector could inject malicious content into update logs or related data fields.
If an administrator subsequently views the affected search results or logs, the injected script may execute within the administrative session.
Successful exploitation could lead to:
- Theft of administrator session data
- Execution of unauthorized actions on behalf of an administrator
- Further compromise of identity-management infrastructure
- Additional lateral movement opportunities within an organization
The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting).
Organizations should upgrade to Auth0 AD/LDAP Connector version 8.0.0 or later to address the issue.
Access Gateway Authorization Bypass Vulnerability
Okta also remediated CVE-2026-78626, an authorization bypass flaw affecting Okta Access Gateway Protected Rules.
Assigned a CVSS score of 8.1, the vulnerability results from improper input sanitization and regular-expression processing during authorization checks.
The issue impacts Access Gateway releases earlier than version 2026.9.1 and can only be exploited when organizations have configured Protected Rule policies for application resources.
An attacker must already possess a valid account assigned to the target application, even if it has minimal privileges. Under these circumstances, specially crafted requests may circumvent Protected Rule enforcement mechanisms.
Successful exploitation could allow users to:
- Access resources that should be restricted
- Bypass authorization controls
- Reach protected application functionality beyond their assigned permissions
The flaw is categorized as CWE-863: Incorrect Authorization.
Okta resolved the vulnerability in Access Gateway version 2026.9.1.
SQL Injection Flaw Impacts Advanced Datastore Configurations
A third vulnerability, CVE-2026-78623, affects Access Gateway's advanced-mode datastore functionality and carries a CVSS score of 7.7.
The issue arises when SAML assertion attributes are inserted into custom database queries without sufficient sanitization.
Affected deployments include Access Gateway environments that:
- Use advanced-mode database datastores
- Rely on custom SQL queries
- Reference SAML assertion attributes within those queries
An authenticated user capable of supplying attacker-controlled values to referenced SAML attributes may be able to manipulate database queries and execute unintended SQL commands.
Depending on database permissions and application design, exploitation could result in:
- Exposure of sensitive information
- Unauthorized modification of records
- Disruption of database operations
- Potential impacts on application availability
The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements Used in an SQL Command (SQL Injection).
Organizations should update affected Access Gateway deployments to version 2026.9.1 or later.
Recommended Actions
Organizations using Auth0 AD/LDAP Connector or Okta Access Gateway should take the following steps:
- Upgrade the Auth0 AD/LDAP Connector to version 8.0.0 or newer
- Upgrade Access Gateway to version 2026.9.1 or later
- Review Protected Rule configurations for potential exposure
- Audit custom datastore queries that utilize SAML attributes
- Verify permissions assigned to directory attributes
- Monitor for unusual modifications to directory records and connector logs
- Review administrative activities for signs of unauthorized actions
Key Takeaway
The vulnerabilities highlight the importance of securing identity infrastructure, which often serves as a critical trust layer across enterprise environments. While exploitation requires specific prerequisites in most cases, successful attacks could provide access to administrative sessions, restricted resources, or backend databases. Organizations running affected versions of Auth0 AD/LDAP Connector or Okta Access Gateway should apply the available updates as soon as possible and review their configurations for potential exposure.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
