CVE-2026-78631 — Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of…
Published: 2026-09-08 · CVSS: 5.3 · CVSS 3.1
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7