CVE-2026-78631 in Hyperdrive Agent
Summary
by MITRE • 09/09/2026
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The Okta Hyperdrive Agent, designed to facilitate seamless multi-factor authentication for enterprise users, contains a critical security flaw related to improper handling of sensitive authentication data within its logging mechanisms. Specifically, upon the successful completion of an MFA challenge, the agent decodes the SAML bearer assertion and writes this information directly into a local application log file at the default log level. This behavior results in the exposure of live authentication credentials on the endpoint system where the agent is installed. The vulnerability stems from a failure to sanitize or redact sensitive tokens before persisting them to disk, which violates fundamental principles of secure software development regarding data minimization and protection of secrets in transit and at rest within local storage systems.
From a technical perspective, this issue represents an instance of improper input validation combined with insecure logging practices. The SAML bearer assertion serves as a critical token that authenticates the user to downstream applications relying on Okta for identity management. By writing the decoded version of this assertion to a log file accessible by local users, the system effectively creates a plaintext copy of the authentication credential. Any process or user account with read permissions to the specific log directory can retrieve this information. This exposure bypasses network-level security controls and relies solely on operating system file permission settings for protection, which are often misconfigured in enterprise environments where shared workstations or compromised local accounts may exist.
The operational impact of this vulnerability is severe, as it allows an attacker with local access to the affected machine to perform session hijacking attacks. By capturing the SAML bearer assertion from the log files, an adversary can replay this token against Okta's identity provider services to gain unauthorized access to any application that trusts the Okta federation. This effectively compromises not just the individual user account but potentially all resources associated with that identity within the enterprise ecosystem. The risk is exacerbated by the fact that these logs are often retained for extended periods and may be aggregated into centralized logging systems, thereby expanding the blast radius of the exposure beyond the local endpoint to any system capable of reading those log streams if proper access controls are not enforced on the SIEM or log management infrastructure itself.
This vulnerability aligns with CWE-532, which covers information exposure through log files, and falls under the ATT&CK technique T1078, specifically valid accounts used for lateral movement or persistence. It also relates to CWE-209 regarding the generation of error messages containing sensitive information. To mitigate this risk, organizations should immediately apply vendor-provided patches that address the logging behavior in the Okta Hyperdrive Agent. In the interim, administrators can implement workarounds such as restricting file system permissions on the log directories to ensure only privileged service accounts have read access, although this is less effective than a code-level fix. Additionally, implementing strict monitoring for unusual authentication patterns and reviewing existing logs for exposed tokens are recommended steps to assess potential compromise. Long-term remediation should involve enforcing least-privilege principles across all endpoint logging configurations and ensuring that security tools automatically redact sensitive data such as SAML assertions, OAuth tokens, and API keys before they are written to any persistent storage medium.