Okta Access Gateway EUVD-2026-108568

Exploitation requires the attacker to already be an authenticated OAG user with an active session; the attacker then alters the authentication-source parameter during sign-on, which OAG fails to validate, producing a SAML assertion that grants Admin Console access. Limiting factors: valid credentials / an active session are mandatory (this is privilege escalation, not unauthenticated access), the target product is specifically Okta Access Gateway (per CPE cpe:2.3:a:okta:okta_access_gateway), and the vendor's CVSS AC:H indicates the parameter manipulation is not trivial to perform reliably. No special non-default configuration or user interaction is described as required beyond possessing an authenticated session.

This is a credible privilege-escalation issue that warrants prompt attention but is not an emergency. The vendor-assigned CVSS of 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network reach and full confidentiality/integrity/availability impact via unauthorized Admin Console access, tempered by high attack complexity. A key internal conflict must be flagged: the CVSS vector states PR:N (no privileges required), yet the description explicitly requires 'an authenticated user with an active session' who modifies the authentication source parameter - this is an authenticated privilege-escalation flaw, not an unauthenticated bypass, so PR:N appears incorrect and authentication requirements should be read from the description, not the vector. CWE-639 (authorization bypass through a user-controlled key) matches the described mechanism: the authentication source is user-modifiable and not server-validated. No EPSS score, no CISA KEV listing, and no public PoC or exploit reference were provided, so there is no evidence of active or at-scale exploitation; the vuln.today decision label is 'this_week', consistent with a serious-but-not-actively-exploited item. The real priority is elevated because the outcome is Admin Console (administrative) access and the reporter is the vendor itself, but the authenticated precondition plus AC:H meaningfully constrain opportunistic mass exploitation. Patch availability and fixed versions are not stated in the supplied data and must be confirmed via the Okta advisory.

An attacker who already holds a valid OAG user account (for example a low-privilege employee or a compromised standard credential) establishes an active session, then tampers with the authentication-source parameter during sign-on. Because OAG does not validate the selected authentication source, the manipulated request yields a SAML assertion that grants access to the Admin Console, escalating the attacker from ordinary user to administrator. No public exploit identified at time of analysis; the high attack complexity implies the precise parameter manipulation is non-trivial.