EUVD-2026-74165
GHSA-9j47-j79g-74hf
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Network-accessible SAML path; AC:H for non-trivial assertion crafting; PR:L for required SAML identity; S:C for backend database scope change.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
4DescriptionCVE.org
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.
AnalysisAI
SQL injection in Okta Access Gateway's advanced mode datastore configuration exposes backend databases to arbitrary query execution by attackers who hold a valid SAML identity. The gateway interpolates SAML assertion attribute values directly into query strings prior to preparation, bypassing parameterization entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions simultaneously: (1) The attacker must hold a valid SAML identity authenticating through the Okta Access Gateway - confirmed by PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L) accurately captures a meaningful but non-trivial-to-execute vulnerability: AC:H reflects that the attacker must be able to inject SQL metacharacters into SAML assertion attribute values, which requires either controlling an IdP-side attribute field or compromising an upstream IdP - not a zero-effort operation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Okta Access Gateway to version 2026.9.1 or later, which resolves the injection by implementing proper parameterization of SAML assertion values before database query execution. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Okta Access Gateway instances running in advanced mode and determine which backend databases are exposed through the gateway; request patch details and deployment timeline from your Okta account team. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today