medium6.6
CVE-2026-78550
The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session.
Impact
The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Okta | Access Gateway | before 2026.9.1 |