CVE-2026-78628: Improper Input Validation in Okta Okta Credential Provider for Windows

The Okta Credential Provider for Windows fails to validate the size and string offsets of a serialized credential buffer before interpreting it as a Kerberos logon structure. This improper input validation can cause the credential provider process to terminate unexpectedly or result in out-of-bounds memory access, potentially disclosing adjacent memory contents into local system logs. The vulnerability affects versions >=0 and <1.4.6.0 of the product.

Successful exploitation can cause denial of service by crashing the credential provider process or lead to information disclosure through out-of-bounds memory reads. The disclosed memory may include sensitive adjacent process data logged locally. The CVSS 3.1 base score is 6.0 (medium severity), reflecting local attack vector with low complexity, requiring high privileges and no user interaction, impacting confidentiality and integrity but not availability.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted serialized credential buffers and monitor for updates from Okta.