CVE-2026-78635: Improper Neutralization of Argument Delimiters in a Command in Okta Okta Privileged Access Client

The Okta Privileged Access Client URL handler does not properly neutralize argument delimiters when constructing command-line arguments. Specifically, it omits an option terminator before appending the target value. If a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework treats it as a command-line flag rather than a positional argument. This can cause unintended modification of the SSH client's behavior, which may impact confidentiality, integrity, and availability to a limited extent.

This vulnerability can lead to unintended modification of the SSH client's behavior due to improper handling of command-line arguments. The CVSS score of 5.0 (medium severity) reflects limited but non-negligible impact on confidentiality, integrity, and availability. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling scaleft:// protocol handler links containing values that begin with a hyphen. Avoid clicking on untrusted or suspicious links that invoke the Okta Privileged Access Client.