Executive brief
Okta Privileged Access is a client application that provides secure SSH access to infrastructure resources. The application's URL protocol handler fails to properly validate user-supplied input, allowing an attacker to inject malicious command-line arguments via a specially crafted link. An attacker could exploit this to modify SSH client behavior and gain unauthorized access or intercept sensitive session data.
Technical details
The vulnerability is an argument injection flaw (CWE-88) in the Okta Privileged Access client's URL handler for the scaleft:// protocol. When the handler constructs command-line arguments to pass to the underlying SSH client, it fails to insert an option terminator (--) before appending the target value. This allows an attacker to craft a scaleft:// link with a target parameter beginning with a hyphen, which the CLI framework then interprets as a command-line flag rather than a positional argument. The attack requires user interaction (clicking a malicious link) but no authentication. An attacker can achieve limited impact through command-line flag injection to modify SSH client behavior. The vulnerability affects versions 1.18.0 through 1.112.0 and is fixed in version 1.113.0.
Affected products
- Okta Privileged Access client 1.18.0 through 1.112.0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in version 1.113.0