Authentication Source Verification Flaw in Okta Access Gateway

CVE-2026-115546

What is CVE-2026-115546?

The Okta Access Gateway presents a critical flaw where it fails to properly validate the authentication source during the sign-on process. This vulnerability allows an authenticated user with an active session to manipulate the authentication source parameter, potentially generating a malicious SAML assertion. This could enable unauthorized access to sensitive areas such as the Admin Console, leading to significant security risks for organizations relying on Okta's services.

References