Input Validation Flaw in Okta Credential Provider for Windows

CVE-2026-78628

What is CVE-2026-78628?

The Okta Credential Provider for Windows exhibits a vulnerability due to improper validation of serialized credential data. Specifically, it fails to verify the size and structure of credential buffers before using them, which can lead to unwanted termination of the credential provider process. Additionally, this vulnerability may expose sensitive information through out-of-bounds memory accesses, potentially allowing the disclosure of adjacent process memory into system logs. Proper handling of input is crucial to maintain robust security in authentication processes.

References