CVE-2026-115546 in Access Gateway
Summary
by MITRE • 10/23/2026
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Okta Access Gateway involves a critical flaw in the authentication flow logic where the system fails to properly validate the selected authentication source during the sign-on process. This issue stems from an insecure direct object reference or improper validation of user-supplied input, specifically regarding the parameter that dictates which identity provider or internal directory should be used for authenticating the user. In a secure implementation, once a session is established and authenticated, subsequent actions such as accessing administrative interfaces like the Admin Console must strictly enforce the original authentication context to prevent privilege escalation. However, in this scenario, an attacker who has already obtained valid credentials and maintains an active session can manipulate the request parameters to switch the authentication source dynamically. This manipulation allows the system to generate a Security Assertion Markup Language assertion that incorrectly attributes administrative privileges to the user based on the altered parameter rather than their actual role or permission set within the original identity provider context.
From a technical perspective, this flaw represents a significant breakdown in session management and access control enforcement mechanisms. The core issue lies in the server-side processing of the authentication source identifier without verifying its consistency with the initial login event or checking if the user possesses the requisite permissions for that specific source. By altering this parameter, an authenticated user can effectively bypass role-based access controls designed to restrict administrative functions to authorized personnel only. This behavior aligns closely with Common Weakness Enumeration category CWE-284, which describes Improper Access Control, as well as CWE-613, Insufficient Session Expiration, in the context of maintaining session integrity during privilege-sensitive operations. The ability to modify this parameter suggests that the application relies on client-side or easily interceptable request data for critical security decisions without sufficient server-side validation against a trusted state store.
The operational impact of this vulnerability is severe, primarily because it facilitates unauthorized administrative access within the Okta environment. An attacker leveraging this flaw can gain full control over the Admin Console, which serves as the central hub for managing users, applications, policies, and security settings across the organization's identity infrastructure. With admin-level privileges obtained through this method, an adversary could perform a wide range of malicious activities including creating new administrative accounts to maintain persistence, modifying multi-factor authentication policies to weaken overall security posture, exporting sensitive user data, or disabling critical security alerts. This level of access effectively compromises the entire Okta tenant, allowing for further lateral movement and potential compromise of all connected enterprise applications that rely on Okta for single sign-on services.
This vulnerability is also relevant to MITRE ATT&CK techniques related to privilege escalation and account manipulation. Specifically, it mirrors aspects of T1078 Valid Accounts, where an attacker uses legitimate credentials but exploits a flaw in the application logic to gain higher-level access than intended. It also touches upon T1548 Abuse Elevation Control Mechanism, as the vulnerability allows bypassing standard elevation controls by manipulating the authentication context. The exploitation path typically involves intercepting network traffic using tools like Burp Suite or OWASP ZAP during an active session and modifying specific parameters in HTTP requests directed at Okta Access Gateway endpoints before they are processed to generate SAML assertions for administrative access.
Mitigation strategies must focus on implementing robust server-side validation of all authentication-related parameters regardless of their origin. Developers should ensure that the authentication source is immutable once a session has been initiated or strictly validated against the user's profile and permissions at every step where privilege escalation occurs. Implementing strict input validation, using anti-forgery tokens for state-changing requests, and enforcing security contexts based on server-side sessions rather than client-supplied data are essential steps to resolve this issue. Additionally, Okta has released patches addressing these specific flaws in their Access Gateway software versions 2019.3.4 through 2020.6.5. Organizations running affected versions should immediately apply the latest security updates provided by Okta. Until patching is complete, administrators can mitigate risk by restricting network access to the Admin Console interface and monitoring for unusual authentication patterns or privilege changes within the tenant logs.