The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Tue, 08 Sep 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior. | |
| Title | Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument | |
| Weaknesses | CWE-88 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Okta
Published: 2026-09-08T20:14:00.691Z
Updated: 2026-09-08T20:14:00.691Z
Reserved: 2026-08-24T22:06:37.295Z
Link: CVE-2026-78635
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-09-08T21:18:41.680
Modified: 2026-09-09T16:03:22.897
Link: CVE-2026-78635
Redhat
No data.