Skip to content
OpenAdvisories
Medium · 5.0 CVE-2026-78635 EUVD-2026-74179GHSA-wf33-c5j5-v44h

Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument

Published Sep 8, 2026 · Updated Sep 10, 2026 · Assigned by Okta

Description

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.

Affected products

VendorProductAffectedFixed
Okta Okta Privileged Access Client 1.18.0 – < 1.113.0 1.113.0

References