VulnerabilityUndergoing Analysis

CVE-2026-78625

The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.

MEDIUM 6.7EPSS 0.16%

Does this matter?

Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own.

Description

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.

CVSS 3.1: 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.16% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-94
Source: psirt@okta.com

References

https://trust.okta.com/security-advisories/insufficient-validation-of-dashboard-application-labels-in-okta-access-gateway-dashboard-site-configuration-cve-2026-78625

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.