The Okta Privileged Access Client's URL handler fails to properly neutralize argument delimiters when processing scaleft:// protocol handler links. Specifically, it does not insert an option terminator before appending the target value to the command-line arguments. If the target value begins with a hyphen, the underlying CLI framework interprets it as a command-line flag, which can cause unintended modifications to the SSH client's behavior. This vulnerability affects version 1.18.0 of the client. No official remediation or patch information is currently available.

An attacker who can craft a scaleft:// protocol handler link with a target value starting with a hyphen may cause the SSH client to behave unexpectedly by injecting command-line flags. This can lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling scaleft:// protocol links from untrusted sources to avoid unintended command-line argument injection.