Executive brief
Okta Access Gateway, an identity and access management appliance used to control application access, fails to sanitize dashboard label text before writing it into PHP configuration files. An authenticated administrator can inject malicious code through dashboard labels, which executes with web server privileges whenever users authenticate, potentially leading to account compromise or unauthorized access.
Technical details
The vulnerability is a code injection (CWE-94) in Okta Access Gateway's dashboard site configuration feature. User-supplied dashboard application label values are not sanitized before being written into auto-included PHP configuration files used during authentication. An authenticated user with administrator privileges and access to the management interface can inject arbitrary PHP code via dashboard labels. The injected code executes in the context of the web server process whenever an authentication request triggers the inclusion of the generated configuration file. The vulnerability is resolved in version 2026.9.1 and later.
Affected products
- Okta Access Gateway prior to 2026.9.1
Timeline
- 2026-09-08: disclosed
- 2026-09-01: patched: Fixed in version 2026.9.1