🔴 Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection

Okta has released security updates for three high-severity vulnerabilities affecting the Auth0 AD/LDAP Connector and Okta Access Gateway.

These vulnerabilities could allow authenticated attackers to trigger stored cross-site scripting (XSS), bypass Protected Rule authorization controls, or execute unintended SQL commands against configured backend databases under specific deployment conditions.

All three vulnerabilities were disclosed on September 8, 2026. Organizations using the affected Auth0 connector or Okta Access Gateway should prioritize upgrading, especially if they use directory attributes, Protected Rules, or custom SQL-backed advanced datastores.