Skip to main content

Okta Access Gateway EUVDEUVD-2026-74177

| CVE-2026-78579 MEDIUM
LDAP Injection (CWE-90)
2026-09-08 psirt@okta.com GHSA-vx4x-6r95-wf4x
LDAP Code Injection
6.8
CVSS 3.1 · Vendor: okta
Share

Severity by source

Vendor (okta) PRIMARY
6.8 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
6.8 MEDIUM

AV:N for SAML-over-network delivery; AC:H because attacker must know filter structure and survive assertion encoding; PR:L for IdP authentication; C:H/I:H for directory read/modify; A:N confirmed.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (okta).

CVSS VectorVendor: okta

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Metadata Corrected
Sep 09, 2026 - 03:40 vuln.today
tag: Denial Of Service removed
Analysis Generated
Sep 09, 2026 - 03:26 vuln.today
Patch available
Sep 08, 2026 - 21:20 EUVD

DescriptionCVE.org

The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic.

AnalysisAI

LDAP injection in Okta Access Gateway versions before 2026.9.1 allows a network-authenticated attacker to manipulate LDAP search filter logic by supplying crafted SAML assertion attribute values. Because the Access Gateway interpolates raw SAML attribute values directly into LDAP filter strings without sanitization, an attacker controlling those values can inject LDAP metacharacters to rewrite the intended query - potentially bypassing authorization decisions or extracting sensitive directory entries. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid SAML identity (PR:L) - authenticated to the upstream identity provider - and must be able to control or influence SAML assertion attribute values that the Okta Access Gateway subsequently uses to construct LDAP search filters. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 6.8 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N captures the key constraints accurately. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Okta Access Gateway to version 2026.9.1 or later, which contains the vendor-released patch per the advisory at https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-ldap-datastore-filter-interpolation-cve-2026-78579. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in LDAP

View all
CVE-2016-9299 CRITICAL POC
9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
CVE-2017-14596 CRITICAL POC
9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

CVE-2017-8790 CRITICAL POC
9.8 May 05

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2023-28853 MEDIUM POC
6.5 Apr 04

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
CVE-2020-36966 MEDIUM POC
6.4 Jan 30

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
CVE-2025-36556 MEDIUM POC
6.1 Jan 20

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
CVE-2026-23906 CRITICAL
9.8 Feb 10

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
CVE-2026-44930 CRITICAL
9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
CVE-2024-33868 CRITICAL
9.8 May 14

An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2023-6905 CRITICAL
9.8 Dec 18

A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i
CVE-2021-43350 CRITICAL
9.8 Nov 11

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P
CVE-2026-46619 CRITICAL
9.3 Jun 26

Authentication bypass in Open Identity Platform OpenAM Community Edition (through 16.0.6) lets an unauthenticated remote

Same weakness CWE-90 – LDAP Injection

View all
CVE-2016-9299 CRITICAL POC
9.8
CVE-2017-14596 CRITICAL POC
9.8
CVE-2017-8790 CRITICAL POC
9.8
CVE-2023-28853 MEDIUM POC
6.5
CVE-2026-44930 CRITICAL
9.8
CVE-2024-33868 CRITICAL
9.8
CVE-2023-6905 CRITICAL
9.8
CVE-2021-43350 CRITICAL
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

EUVD-2026-74177 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy