Skip to content
OpenAdvisories
Medium · 6.6 CVE-2026-78550 EUVD-2026-74164GHSA-7r5r-h4wq-43gr

Improper Input Handling in Okta Access Gateway Management Console Exception Handler

Published Sep 8, 2026 · Updated Sep 10, 2026 · Assigned by Okta

Description

The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.

Affected products

VendorProductAffectedFixed
Okta Okta Access Gateway < 2026.9.1 2026.9.1

References