What is GHSA-5fhg-v2mq-37m7?

GHSA-5fhg-v2mq-37m7 is a security advisory published by GitHub Security Advisories with Medium severity. The Okta Access Gateway backup restore function does not validate the filename embedded in an...

Which CVE IDs does GHSA-5fhg-v2mq-37m7 cover?

GHSA-5fhg-v2mq-37m7 covers the following CVE IDs: CVE-2026-78624. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5fhg-v2mq-37m7?

GHSA-5fhg-v2mq-37m7 has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

GHSA-5fhg-v2mq-37m7MediumCVSS 4.9

The Okta Access Gateway backup restore function does not validate the filename embedded in an...

Vendor

GitHub Security Advisories

Published

September 8, 2026

Last Modified

September 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-78624 →

📋 Description

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-78624
https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624
https://github.com/advisories/GHSA-5fhg-v2mq-37m7