What is CVE-2026-78620?

CVE-2026-78620 is a medium-severity vulnerability, classified under External Control of File Name or Path. CVSS score: 5.9/10. Published 2026-09-08.

How severe is CVE-2026-78620?

Medium severity. CVSS v3 base score is 5.9 out of 10.

CVE-2026-78620

CVE-2026-78620

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N.

Weakness classification (CWE)

CWE-73 — External Control of File Name or Path

References

psirt@okta.com

Frequently asked questions

What is CVE-2026-78620?: CVE-2026-78620 is a medium-severity vulnerability, classified under External Control of File Name or Path. CVSS score: 5.9/10. Published 2026-09-08.
How severe is CVE-2026-78620?: Medium severity. CVSS v3 base score is 5.9 out of 10.