CVE-2026-78623EPSS p36.9%

CVE-2026-78623CVE-2026-78623

okta / access_gateway

Description

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.

Scoring

CVSS 7.7 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS0.45% probability of exploitation · percentile 36.9% · 2026-10-05T12:00:23Z
Last modified2026-09-22
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.