CVE-2026-78635
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
Risk Assessment
The risk involves potential unauthorized modification of SSH client behavior, which could lead to unexpected actions or potential security compromise of SSH sessions.
Recommendation
It is recommended to update the Okta Privileged Access client to a version that properly handles the option terminator. Also exercise caution when clicking scaleft:// links from untrusted sources.
Other vulnerabilities in Okta Privileged Access
Original NVD description (English source)
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS