CVE-2026-78628

CVE-2026-78628 · Improper Input Validation in the Okta Credential Provider for Windows

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate unexpectedly or lead to out-of-bounds memory reads and writes, which may result in the disclosure of adjacent process memory into local system logs.

CVSS 6.0 · Moyenne · EPSS 0,1% · Correctif disponible

Publication

2026-10-13T20:07:37.375Z

Mise à jour

2026-10-14T19:27:28.784Z

Vérifiez votre serveur →