Okta Access Gateway does not validate the selected authentication source during sign‑on, allowing an authenticated user with an active session to modify the authentication source parameter. This action can generate a SAML assertion that grants access to the Admin Console, effectively elevating privileges and enabling unauthorized administrative operations. The flaw involves improper authentication (CWE‑287) and privileged escalation (CWE‑639).

All Okta Access Gateway appliances running versions prior to 2026.10.2 are affected. The issue is present in the OAG firmware and appliance software that lack the authentication source validation introduced in the 2026.10.2 release.

The vulnerability carries a CVSS score of 8.1, indicating a high severity. EPSS data is not available, and it is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to already possess legitimate credentials or an active session; once authenticated, they can alter the authentication source parameter to elevate privileges. The need for an existing authenticated session limits the attack surface, but within that scope the impact is significant, allowing full administrative control of the Okta environment.