CVE-2026-78552 — Validation Bypass in Okta Access Gateway Custom Directives
The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx serve…
Published: 2026-09-08 · CVSS: 6.0 · CVSS 3.1
The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7