AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OktaCVE-2026-78627

Okta Hyperdrive Integration Plugin: secrets in logs

Okta

CVE-2026-78627 · Published Sep 8, 2026 · updated Sep 22, 2026

High7.3
Fix: upgrade to 1.5.2 or later
Okta advisory

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation.

Affected versions

PackageAffectedFixed in
Okta Hyperdrive Integration Plugin
Product
>= 1.2.0, < 1.5.21.5.2
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-532

More Okta advisories

All Okta
Medium 6.7Sep 8Okta Auth0 AD/LDAP Connector: missing authenticationCVE-2026-85981no fix yetCritical 9.0Sep 8Okta Auth0 AD/LDAP Connector: cross-site scriptingCVE-2026-85982no fix yetHigh 7.8Sep 8Okta Auth0 AD/LDAP Connector: code executionCVE-2026-85983no fix yetMedium 6.5Sep 8The react-native-auth0 SDK's web platform implementation does not scope its...CVE-2026-84685fixed in 5.11.1Medium 6.0Sep 8Okta Verify for Windows: link followingCVE-2026-78622fixed in 7.0.0Medium 5.6Sep 8The Okta Hyperdrive agent plugin returns a success response without a signed...CVE-2026-78629fixed in 1.5.2