CVE-2026-78622: Improper Link Resolution Before File Access in Okta Okta Verify for Windows

The Okta Verify for Windows uninstaller fails to check whether the user data directory is a filesystem junction before performing deletion operations with elevated privileges. Because the delete operation follows the junction target, it recursively deletes files and directories beyond the intended scope, potentially causing extensive unintended data removal. This vulnerability affects versions 5.1.3 up to but not including 7.0.0.

The vulnerability allows an attacker or user with limited privileges to cause a recursive deletion of unintended directory contents by exploiting the uninstaller's improper handling of filesystem junctions. This can result in denial of service through data loss or system disruption. The CVSS score of 6.0 (medium severity) reflects the requirement for local access with high attack complexity and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running the uninstaller in environments where filesystem junctions are present in the user data directory or restrict uninstaller execution to trusted administrators. Monitor Okta's advisories for updates on patches or official mitigations.