OktaCVE-2026-78627
Okta Hyperdrive Integration Plugin: secrets in logs
High7.3CVE-2026-78627 · Published Sep 8, 2026 · updated Sep 22, 2026
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Okta Hyperdrive Integration Plugin Product | >= 1.2.0, < 1.5.2 | 1.5.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-532
More Okta advisories
All Okta| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 8 | Okta Auth0 AD/LDAP Connector: missing authentication | Medium6.7 | No fix yet |
| Sep 8 | Okta Auth0 AD/LDAP Connector: cross-site scripting | Critical9.0 | No fix yet |
| Sep 8 | Okta Auth0 AD/LDAP Connector: code execution | High7.8 | No fix yet |
| Sep 8 | The react-native-auth0 SDK's web platform implementation does not scope its... | Medium6.5 | 5.11.1 |
| Sep 8 | Okta Verify for Windows: link following | Medium6.0 | 7.0.0 |
| Sep 8 | The Okta Hyperdrive agent plugin returns a success response without a signed... | Medium5.6 | 1.5.2 |