EUVD-2026-74179
GHSA-wf33-c5j5-v44h
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Network-delivered via crafted URL; AC:H for social engineering and flag-acceptance conditions; UI:R required; limited C/I/A since injected flags modify SSH behavior rather than granting direct shell access.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
2DescriptionCVE.org
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
AnalysisAI
Argument injection in the Okta Privileged Access Client's scaleft:// URL protocol handler allows an unauthenticated remote attacker to manipulate SSH client behavior by supplying hyphen-prefixed values in a crafted link. Versions 1.18.0 through 1.112.x omit the option terminator (--) before appending URL-derived values to SSH command-line arguments, causing the underlying SSH binary to interpret attacker-controlled strings as CLI flags rather than literal targets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Okta Privileged Access Client version 1.18.0 through <1.113.0 must be installed on the victim's system, and the scaleft:// URI scheme must be registered with the OS protocol handler (standard during client installation). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L, score 5.0) accurately reflects the moderate exploitation complexity: the attack is network-delivered but requires user interaction (clicking a crafted link) and high complexity conditions (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Okta Privileged Access Client to version 1.113.0 or later, which introduces the -- option terminator before appending the URL-supplied target to SSH arguments, preventing interpretation of user-controlled values as flags. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today