Description
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.
Published: 2026-09-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Authentication Credential Exposure
Action: Patch Immediately
AI Analysis

Impact

The Okta Hyperdrive Agent logs the decoded SAML bearer assertion to a local file each time multi‑factor authentication succeeds. Because the assertion contains a live authentication credential, any local user who can read the log file can obtain that credential. This vulnerability falls under improper leakage of sensitive information.

Affected Systems

Okta Hyperdrive Agent is affected. The advisory recommends upgrading to version 1.5.2 or higher. No other product variations or operating systems are mentioned.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is local: an attacker must have read access to the agent log file. Once the log is accessed, the attacker can extract the bearer assertion and impersonate the authenticated user.

Generated by OpenCVE AI on September 9, 2026 at 10:23 UTC.

Remediation

Vendor Solution

Upgrade the Okta Hyperdrive Agent to version 1.5.2 or greater.

OpenCVE Recommended Actions

  • Upgrade the Okta Hyperdrive Agent to version 1.5.2 or newer.
  • Restrict file system permissions on the Hyperdrive Agent log files so that only privileged users can read them.
  • If the agent configuration supports it, disable or mask logging of decoded SAML bearer assertions to prevent sensitive data from being written to the log.

Generated by OpenCVE AI on September 9, 2026 at 10:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Okta hyperdrive
CPEs cpe:2.3:a:okta:hyperdrive:*:*:*:*:*:*:*:*
Vendors & Products Okta hyperdrive

Sun, 13 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Okta
Okta okta Hyperdrive Agent
Vendors & Products Okta
Okta okta Hyperdrive Agent

Thu, 10 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.
Title Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
Weaknesses CWE-532
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Okta Hyperdrive Okta Hyperdrive Agent
cve-icon MITRE

Status: PUBLISHED

Assigner: Okta

Published:

Updated: 2026-09-10T14:41:26.342Z

Reserved: 2026-08-24T22:04:00.475Z

Link: CVE-2026-78631

cve-icon Vulnrichment

Updated: 2026-09-10T14:41:12.534Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T21:18:41.570

Modified: 2026-09-22T20:02:04.043

Link: CVE-2026-78631

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T20:06:46Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File