CVE-2026-78625 PUBLISHED

Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration

Assigner: Okta
Reserved: 24.08.2026 Published: 08.09.2026 Updated: 08.09.2026

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 6.7

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Okta
Product	Okta Access Gateway
Versions	Default: unaffected affected from 0 to 2026.9.1 (excl.)

Solutions

Upgrade Okta Access Gateway to version 2026.9.1 or greater.

References

https://trust.okta.com/security-advisories/insufficient-validation-of-dashboard-application-labels-in-okta-access-gateway-dashboard-site-configuration-cve-2026-78625

Problem Types

Improper Control of Generation of Code