On September 8, 2026, Okta revealed fixes for three serious security flaws impacting its Auth0 AD/LDAP Connector and Access Gateway. The vulnerabilities—enabling stored cross-site scripting (XSS), authorization bypass, and SQL injection—require urgent attention from organizations using these identity and access management tools, especially where sensitive applications or privileged users are involved.
Major Flaw: Auth0 AD/LDAP Connector XSS
The gravest issue, labeled CVE-2026-85982, targets the Auth0 AD/LDAP Connector. It earned a CVSS v3 score of 9.0 due to a stored XSS vulnerability. This arises from a failure to properly HTML-encode directory search-result data and updater log content displayed in the Connector’s administrative panel. Potential attackers could exploit this if they have authenticated access to a connected directory with permission to alter user-editable attributes, or a low-privileged local user with access to the host where the connector runs. The malicious payload would execute when an admin views infected search results or updater logs in the Auth0 admin panel.
Access Gateway: Authorization Bypass and SQL Injection Risks
Another critical flaw, CVE-2026-78626, affects Protected Rules in Okta Access Gateway. With a CVSS v3 score of 8.1, it originates from improper input sanitization combined with regex evaluation during secured resource authorization checks. Exploitation requires a Protected Rule policy in place and an active authenticated user account tied to the target application. Low-privileged users might bypass intended authorization and access restricted app resources. This issue is fixed in Access Gateway version 2026.9.1.
The third issue, CVE-2026-78623, also affects Access Gateway’s advanced-mode datastores. It involves SQL injection when custom database queries use SAML assertion attributes without proper sanitization. Attackers need an active session where they can control at least one assertion attribute. Because values are interpolated directly into SQL statements before query preparation, malicious input could trigger unintended database commands. Impacts may include sensitive data exposure, record alterations, or even database availability issues. This is also addressed in version 2026.9.1.
Mitigation Guidance
To protect against these vulnerabilities, administrators should take several actions: identify currently in-use versions of Auth0 AD/LDAP Connector and Access Gateway, then apply the updates—specifically upgrade the Connector to version 8.0.0 or later, and Access Gateway to version 2026.9.1 or newer. Review Protected Rule settings to ensure policies behave as expected, audit database queries that rely on SAML attribute values, scrutinize directory attribute permissions, and monitor logs for anomalous changes to connector logs or user-modifiable attributes.
These flaws present serious risks to an organization’s identity infrastructure. The XSS vulnerability in the connector could compromise administrative sessions, while the authorization bypass and SQL injection in Access Gateway potentially give unauthorized access or data manipulation. The timing of the disclosure and the severity scores underscore that these are not peripheral issues—they strike at the core of application protection and identity management.
