medium6.7

CVE-2026-78625

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files.

Impact

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.

Affected products

Vendor	Product	Affected versions
Okta	Access Gateway	before 2026.9.1

Weakness classification

CWE-94

References

NVD record
CVE.org record
https://trust.okta.com/security-advisories/insufficient-validation-of-dashboard-application-labels-in-okta-access-gateway-dashboard-site-configuration-cve-2026-78625