Vulnerability · Published Sep 8, 2026 · Assigned by Okta
CVE-2026-78635Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument
Medium 5.0
In plain English
A medium-severity argument injection in Okta Privileged Access Client from Okta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Okta | Okta Privileged Access Client | 1.18.0 – before 1.113.0 |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L