The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to sanitize and enforce client headers, an unauthenticated user can supply an arbitrary identity value to initiate a session.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Tue, 08 Sep 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to sanitize and enforce client headers, an unauthenticated user can supply an arbitrary identity value to initiate a session. | |
| Title | Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source | |
| Weaknesses | CWE-287 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Okta
Published: 2026-09-08T20:09:46.636Z
Updated: 2026-09-08T20:09:46.636Z
Reserved: 2026-08-24T20:01:42.878Z
Link: CVE-2026-78560
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-09-08T20:18:36.220
Modified: 2026-09-08T21:13:32.293
Link: CVE-2026-78560
Redhat
No data.