CVSS 3.1
5.0 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:LCVE-2026-78635
Medium (5.0). EPSS 0.2% chance of exploitation in the next 30 days.
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-11-01)
- CWE
- CWE-88
- Published
- Modified
- Record from
- the NVD, synced