CVE-2026-78560: Okta Access Gateway Auth Bypass Flaw

CVE-2026-78560 Overview

CVE-2026-78560 is an improper authentication vulnerability [CWE-287] in the Okta Access Gateway. The product includes an optional pass-through authentication source that accepts a user identity from a client-supplied HTTP header. The header value is trusted without cryptographic validation.

When the optional source is enabled without an upstream reverse proxy or firewall sanitizing client headers, an unauthenticated attacker can supply an arbitrary identity value. That value initiates a session as the chosen user. Exploitation depends on a specific deployment configuration, which raises attack complexity.

Critical Impact
An unauthenticated network attacker can impersonate arbitrary users by injecting a client-controlled identity header, bypassing authentication on affected Okta Access Gateway deployments.

Affected Products

Okta Access Gateway deployments that enable the optional pass-through authentication source
Okta Access Gateway instances lacking an upstream reverse proxy that strips or validates client-supplied identity headers
Okta Access Gateway instances lacking a firewall policy that enforces trusted header sources

Discovery Timeline

2026-09-08 - CVE-2026-78560 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78560

Vulnerability Analysis

The Okta Access Gateway (OAG) ships an optional pass-through authentication source. This source is designed for architectures where an upstream component performs authentication and forwards the authenticated identity to OAG in an HTTP header. OAG then treats the header value as an authoritative identity claim.

The vulnerability arises because OAG does not cryptographically validate the header. There is no signature, message authentication code, or mutual TLS binding tying the header value to a trusted upstream. If the deployment does not enforce that clients cannot set the header directly, any network client can supply an arbitrary value.

An attacker sends an HTTP request that includes the identity header set to a target username. OAG accepts the value and establishes an authenticated session for that identity. The attacker then accesses downstream applications protected by OAG under the impersonated user context.

Root Cause

The root cause is trust-boundary confusion. The pass-through source assumes the upstream network path sanitizes client headers, but this assumption is not enforced by OAG itself. In deployments missing that sanitization layer, the authentication decision is delegated to attacker-controlled input.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. The attacker must identify an OAG endpoint with the optional pass-through source enabled and no upstream header sanitization. High attack complexity reflects the specific misconfiguration required.

Exploitation is described in prose only because no verified proof-of-concept has been published. Refer to the Okta Security Advisory for CVE-2026-78560 for vendor-provided technical detail.

Detection Methods for CVE-2026-78560

Indicators of Compromise

Authentication events in OAG logs showing session establishment without a corresponding upstream identity provider transaction
HTTP requests to OAG containing the pass-through identity header originating from client IP ranges outside the trusted proxy tier
Session activity for user identities that did not perform an interactive login within the same time window

Detection Strategies

Compare OAG access logs against upstream identity provider logs to identify sessions created without matching IdP authentication events
Alert on requests where the identity header is present but the source IP is not an approved upstream proxy address
Baseline normal header patterns per source network and flag deviations, particularly identity header injection from user networks

Monitoring Recommendations

Enable verbose authentication logging on OAG and forward events to a centralized SIEM for correlation
Monitor downstream application access for impersonation patterns such as unusual user-agent, geography, or resource access sequences
Review OAG configuration periodically to confirm the pass-through source status and upstream sanitization controls

How to Mitigate CVE-2026-78560

Immediate Actions Required

Audit every Okta Access Gateway deployment to determine whether the pass-through authentication source is enabled
Disable the pass-through authentication source on any OAG instance that does not require it
Where the source is required, verify that an upstream reverse proxy or firewall strips client-supplied identity headers before they reach OAG
Rotate active sessions and review recent authentication events for signs of impersonation

Patch Information

Refer to the Okta Security Advisory for CVE-2026-78560 for vendor-supplied remediation guidance and fixed version information.

Workarounds

Place OAG behind a reverse proxy configured to unset or overwrite the pass-through identity header on all inbound requests
Restrict network access to OAG so only the trusted upstream authentication tier can reach the pass-through endpoint
Enforce mutual TLS between the upstream authenticator and OAG to bind identity assertions to a trusted source

bash

# Example NGINX directive to strip a client-supplied identity header
# before forwarding requests to Okta Access Gateway
location / {
    proxy_set_header X-Forwarded-User "";
    proxy_set_header X-Authenticated-User "";
    proxy_pass https://okta-access-gateway.internal;
}