5300 matches found
CVE-2026-78629
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
CVE-2026-78631
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78623
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...
CVE-2026-78579
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of th...
CVE-2026-78631 Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78631 Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78631
Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This improper restriction of sensitive information makes a live authentication credential readable by any local user with access to that log ...
EUVD-2026-74183
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...
CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
CVE-2026-78629
The Okta Hyperdrive agent plugin contains an improper authentication verification flaw in its MFA response handling. When an organization's policy does not require MFA for a given user, the plugin returns a success response that contains only a bare boolean validation indicator rather than a sign...
EUVD-2026-74181
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...
CVE-2026-78579 Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of th...
CVE-2026-78579
CVE-2026-78579 affects the Okta Access Gateway , specifically its LDAP datastore configuration . The root cause is that SAML assertion attribute values are not sanitized before being interpolated into LDAP search filters, allowing an attacker with low privileges to modify the intended query logic...
EUVD-2026-74177
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of th...
CVE-2026-78579 Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of th...
CVE-2026-78623 Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...
CVE-2026-78623 Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...
CVE-2026-78623
The Okta Access Gateway is vulnerable to SQL injection because it fails to sanitize SAML assertion values before interpolating them into database queries within the advanced mode datastore configuration . These unsanitized values are directly substituted into the query string before preparation, ...
EUVD-2026-74165
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...