SQL Injection Vulnerability in Okta Access Gateway

CVE-2026-78623

What is CVE-2026-78623?

The Okta Access Gateway is vulnerable due to its failure to properly sanitize SAML assertion values before they are incorporated into database queries. This oversight allows maliciously crafted SAML assertions to be directly included in the query string, potentially leading to unintended execution of SQL commands against the backend database. The exploitation of this vulnerability could lead to unauthorized access to sensitive data within the database.

References