CVE-2026-78560

Executive Summary

CVE-2026-78560 is an authentication weakness in Okta Access Gateway involving an optional pass-through authentication source that trusts a client-supplied HTTP header as the authoritative user identity without cryptographic validation. Organizations that enable this optional source without an upstream reverse proxy or firewall to sanitize and enforce client headers are exposed to unauthenticated session initiation using an arbitrary identity value. The vulnerability is rated CVSS 3.1 base score 4.8 (Moderate), with low confidentiality and integrity impact, and requires specific, non-default deployment conditions to be exploitable.

Technical Analysis

The flaw is classified as CWE-287 (Improper Authentication) and resides in an optional configuration of Okta Access Gateway rather than in the default authentication path. Per the NVD description, the product includes an optional pass-through authentication source that "accepts user identity from a client-supplied HTTP header without cryptographic validation."

The core security defect is a trust boundary violation: the gateway treats a header value asserted by the client as an established identity rather than a claim requiring verification. In correctly architected deployments, a trusted upstream component — a reverse proxy or firewall — is expected to strip inbound client-supplied identity headers and inject the authenticated identity header itself after performing authentication. When this optional source is enabled without such an enforcement point, the gateway will accept whatever identity value the client presents directly.

Two properties make this exploitable in the affected configurations:

1. No cryptographic validation. The identity value is not signed, MACed, or otherwise bound to a trusted issuer. There is no mechanism described that proves the header originated from an authenticated upstream system, which means any network-reachable client can forge it.
2. Deployment-dependent exposure. The description explicitly conditions exploitation on the optional source being enabled and the absence of an upstream reverse proxy or firewall "configured to sanitize and enforce client headers." This is why the CVSS vector sets AC:H (High attack complexity) — successful exploitation depends on an administrative misconfiguration rather than the vulnerability triggering in every deployment.

The attack surface is the HTTP interface of Okta Access Gateway. The attack precondition is architectural: the optional pass-through source is active and no header-sanitizing intermediary sits in front of the gateway. The impact per the description is session initiation with an arbitrary identity, i.e., an authentication bypass that grants a session under an attacker-chosen identity, not memory corruption or code execution.

No public proof-of-concept, exploit code, or Nuclei template was identified at the time of reporting. No CVE-specific implementation details (header name, parameter name, or endpoint) are disclosed in the available description; the analysis above is limited to the vulnerability class and mechanism as described.

Exploitation Scenarios

The following attack chain is inferred strictly from the vulnerability class and the NVD description. No specific header name, parameter, or endpoint is disclosed, and none is fabricated here.

Step 1 — Reconnaissance and target identification. An unauthenticated attacker identifies an Okta Access Gateway instance exposed to the network. The attacker determines, through response behavior or known deployment patterns, that the optional pass-through authentication source is in use and that no upstream reverse proxy or firewall is sanitizing client-supplied identity headers. This reconnaissance is the highest-friction step and corresponds to the AC:H rating.

Step 2 — Triggering the flaw class. The attacker crafts an HTTP request to the gateway in which a client-controlled header is set to an arbitrary identity value. Because the pass-through source accepts identity from a client-supplied header without cryptographic validation, and because no upstream component strips or enforces that header, the gateway treats the forged value as a trusted assertion.

Step 3 — Payload/execution. The payload is the header value itself, containing the identity the attacker wishes to assume. No code execution, injection syntax, or memory manipulation is involved — exploitation is a matter of supplying a syntactically acceptable identity string. The attacker selects a target identity based on observed or guessed account naming conventions.

Step 4 — Post-exploitation impact. The gateway initiates a session as the supplied identity. Depending on which identity is chosen, the attacker may obtain a session with the privileges associated with that account. The CVSS vector scores confidentiality and integrity impact as Low (C:L/I:L) and availability as None (A:N), consistent with session-level access that may be constrained in scope but enables access to protected resources and potential follow-on actions within the granted session.

No public PoC available; attack chain is inferred from vulnerability class. The specifics of which HTTP header carries the identity and which endpoint consumes it are not documented in the available intelligence and must be confirmed by the operator against their own configuration.

Impact Assessment

The business impact is conditional. In a properly segmented deployment where an upstream reverse proxy or firewall sanitizes and enforces client headers, exploitation is not achievable, and the residual risk is negligible. In a misconfigured deployment — the optional pass-through source enabled behind no enforcing intermediary — the gateway becomes an unauthenticated identity-assertion endpoint, and an attacker can initiate sessions as arbitrary users.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N reflects the following subscores:

• Attack Vector (N): exploitable remotely over the network.
• Attack Complexity (H): requires a specific, non-default deployment state (optional source enabled, no header-sanitizing intermediary).
• Privileges Required (N): no prior authentication is needed.
• User Interaction (N): no victim action is required.
• Scope (U): impact remains within the gateway's security scope.
• Confidentiality (L): limited access to resources associated with the assumed identity.
• Integrity (L): limited ability to act under the assumed identity.
• Availability (N): no availability impact.

Blast radius is the set of accounts whose identities could be asserted and the resources those accounts can reach through the gateway. The EPSS score of 0.00201 (10.2th percentile) indicates low predicted exploitation activity, and the absence of CISA KEV listing and public exploit code is consistent with a deployment-specific, configuration-gated weakness rather than a weaponized, mass-exploited flaw. The moderate base score plus low EPSS places this in a remediation backlog tier rather than an emergency-response tier, prioritized by whether the affected configuration is actually present.

Detection Guidance

Sigma Rule

title: Okta Access Gateway Pass-Through Header Identity Assertion
id: 8f2c1a44-6b7e-4d19-9c3a-7e5f0a2b9d61
status: experimental
description: Detects requests to Okta Access Gateway carrying client-supplied identity headers consistent with abuse of the optional pass-through authentication source (CVE-2026-78560).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78560
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: okta_access_gateway
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_identity_header:
    cs-header|contains:
      - 'X-Remote-User'
      - 'X-Authenticated-User'
      - 'X-Forwarded-User'
      - 'REMOTE_USER'
  filter_trusted_proxy:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_method and selection_identity_header and not filter_trusted_proxy
falsepositives:
  - Legitimate requests forwarded by a trusted reverse proxy whose source address is not covered by the filter.
  - Header names vary by environment; tune to the specific deployment.
level: medium
tags:
  - attack.t1078
  - cve.2026.78560

YARA Rule

rule CVE_2026_78560_Okta_AG_Header_Identity_Assertion
{
    meta:
        description = "Detects HTTP requests carrying client-supplied identity headers targeting Okta Access Gateway pass-through authentication abuse (CVE-2026-78560)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78560"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $h1 = "X-Remote-User:" ascii nocase
        $h2 = "X-Authenticated-User:" ascii nocase
        $h3 = "X-Forwarded-User:" ascii nocase
        $h4 = "REMOTE_USER:" ascii nocase
        $ag = "Okta Access Gateway" ascii nocase
        $http = "HTTP/" ascii

    condition:
        $http and any of ($h*) and not $ag
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78560 Okta Access Gateway Pass-Through Identity Header Assertion"; flow:established,to_server; http.header; content:"X-Remote-User"; nocase; http.header; content:"X-Authenticated-User"; nocase; distance:0; classtype:attempted-user; reference:cve,2026-78560; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78560; sid:2026785600; rev:1;)

alert http any any -> any any (msg:"CVE-2026-78560 Okta Access Gateway X-Forwarded-User Inject Attempt"; flow:established,to_server; http.header; content:"X-Forwarded-User"; nocase; classtype:attempted-user; reference:cve,2026-78560; sid:2026785601; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method in ("GET", "POST") and
      http.request.headers contains "X-Remote-User" or
      http.request.headers contains "X-Authenticated-User" or
      http.request.headers contains "X-Forwarded-User" ]
  [ network where http.response.status_code in (200, 302) and
      destination.port in (443, 80) ]

Splunk SPL Query

index=web sourcetype=okta_access_gateway
| eval identity_header_present=if(match(_raw, "(?i)(X-Remote-User|X-Authenticated-User|X-Forwarded-User|REMOTE_USER):"), 1, 0)
| where identity_header_present=1
| eval src_is_trusted=if(cidrmatch("10.0.0.0/8", src_ip) OR cidrmatch("172.16.0.0/12", src_ip) OR cidrmatch("192.168.0.0/16", src_ip), 1, 0)
| where src_is_trusted=0
| stats count values(http_method) as methods values(uri_path) as paths by src_ip identity_header_present
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="okta_access_gateway,cve-2026-78560,">
  <rule id="2026785" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.request.headers">\.*X-Remote-User</field>
    <description>CVE-2026-78560: Okta Access Gateway client-supplied identity header detected from untrusted source.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,pci_dss_10.2.4,</group>
  </rule>

  <rule id="2026786" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.request.headers">\.*X-Authenticated-User</field>
    <description>CVE-2026-78560: Okta Access Gateway pass-through identity assertion attempt detected.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="2026787" level="12">
    <if_sid>2026785,2026786</if_sid>
    <field name="http.response.status_code">^20</field>
    <description>CVE-2026-78560: Identity assertion request succeeded - possible authentication bypass session established.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4: a single source (NVD) claims a patch exists, but no version, advisory URL, or independent confirmation was available at the time of reporting. Treat the patch status as unconfirmed until the vendor advisory is reviewed.

1) Immediate mitigations (apply regardless of patch status):

• If the optional pass-through authentication source is not required, disable it. This removes the vulnerable trust path entirely.
• If it is required, ensure a reverse proxy or firewall sits in front of Okta Access Gateway and is configured to strip all inbound client-supplied identity headers, then inject the identity header itself only after authenticating the user. The gateway must never be reachable directly with attacker-controlled identity headers.
• Restrict network access to the gateway's HTTP interface so that only the trusted upstream intermediary can reach it.
• Audit existing deployments to determine whether the optional source is enabled and whether an enforcing intermediary is present. Deployments without the intermediary should be considered exposed.

2) Patch/upgrade steps:

• Confirm patch availability and the fixed version directly with Okta advisories; the NVD-sourced claim could not be independently verified.
• Once a fixed version is confirmed, schedule upgrade of Okta Access Gateway, testing the pass-through authentication configuration in a staging environment before production rollout.
• After upgrade, verify that the header-trust behavior has changed and that client-supplied headers are no longer accepted as authoritative.

3) Long-term hardening:

• Adopt zero-trust header handling as a standard: never accept identity assertions from untrusted network positions without cryptographic validation or an authenticated enforcement point.
• Enforce header sanitization at the network edge as a permanent control, not a per-CVE workaround, so that future header-trust defects do not become exploitable.
• Monitor for unexpected identity headers from untrusted sources using the detection rules above, and alert on successful responses to such requests.
• Maintain configuration baselines that flag when optional authentication sources are enabled, so misconfigurations are detected during change review rather than after exposure.

References

• NVD — CVE-2026-78560: https://nvd.nist.gov/vuln/detail/CVE-2026-78560 (primary source; CNA title, description, CVSS 3.1 vector, CWE-287, EPSS 0.00201, patch claim)
• Okta — Trust and security advisories and Access Gateway product documentation: https://www.okta.com/trust/ (vendor advisory location; confirm fixed version and guidance)
• MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/ (mapped tactic, consistent with identity assertion / session initiation)
• MITRE CWE — CWE-287 Improper Authentication: https://cwe.mitre.org/data/definitions/287.html (weakness classification)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (checked — CVE-2026-78560 not listed; no KEV entry)

No exploit-in-the-wild evidence, public proof-of-concept, Nuclei template, or associated threat actor campaign was identified for CVE-2026-78560 at the time of reporting. EPSS of 0.00201 (10.2th percentile) and absence from CISA KEV indicate low observed exploitation activity.