CVE-2026-115546 — Authentication Source Verification Issue in Okta Access Gateway
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source …
Published: 2026-10-23 · CVSS: 8.1 · CVSS 3.1
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7