CVE-2026-78631: Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Okta Hyperdrive Agentto a version that resolves this vulnerability.Fixed in 1.5.2
Event History
Frequently Asked Questions
Who can use the exposed credential?
Any local user who can read the Hyperdrive Agent application log file can obtain the decoded SAML bearer assertion after a successful MFA completion. Exploitation requires local access and access to that log file.
Does this occur only with verbose logging enabled?
No. The decoded assertion is written at the default log level, so environments using the default logging configuration are affected when successful MFA completions occur.
How can administrators determine whether credentials may have been exposed?
Review Hyperdrive Agent application logs for entries created after successful MFA completions and determine which local users or processes could read those files. The presence of decoded SAML bearer assertions in the logs indicates exposure.