Vulnerability · Published Oct 13, 2026 · Assigned by Okta
CVE-2026-78628Improper Input Validation in the Okta Credential Provider for Windows
Medium 6.0
In plain English
A medium-severity improper input validation in Okta Credential Provider for Windows from Okta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate unexpectedly or lead to out-of-bounds memory reads and writes, which may result in the disclosure of adjacent process memory into local system logs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Okta | Okta Credential Provider for Windows | 0 – before 1.4.6.0 |
Weakness: CWE-20, CWE-125, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N