CVE-2026-78635: Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Okta Privileged Access clientto a version that resolves this vulnerability.Fixed in 1.113.0
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must cause a user to open a scaleft:// protocol-handler link whose target value begins with a hyphen. Exploitation requires user interaction and has high attack complexity.
Is authentication required before exploitation?
No. The vector indicates no privileges are required, although a user must interact with the malicious link.
What is the practical impact of a successful exploit?
The malformed target is interpreted as a command-line flag by the underlying CLI framework, which can unintentionally alter the SSH client's behavior. The reported impact includes low confidentiality, integrity, and availability effects.