CVE-2026-78627: Okta Hyperdrive Information Disclosure

CVE-2026-78627 Overview

CVE-2026-78627 affects the Okta Hyperdrive Integration installer. The installer fails to mask the OAuth client secret when the credential is passed as a Microsoft Installer (MSI) property. As a result, the plaintext secret is recorded in the installer log, the Windows Application Event Log, and the process command line. Any authenticated local user on the workstation can read these locations and recover the credential. The issue is classified under [CWE-532: Insertion of Sensitive Information into Log File].

Critical Impact
An authenticated local user on a workstation running the Okta Hyperdrive Integration installer can retrieve the OAuth client secret in plaintext and reuse it to impersonate the integration against Okta.

Affected Products

Okta Hyperdrive Integration installer (MSI)
Windows workstations executing the installer with an OAuth client secret passed as an MSI property
Environments retaining installer logs or Application Event Log entries generated during installation

Discovery Timeline

2026-09-08 - CVE-2026-78627 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78627

Vulnerability Analysis

The Okta Hyperdrive Integration installer accepts the OAuth client secret through an MSI property during installation. The installer does not flag the property as sensitive, so Windows Installer processes and records it in cleartext. The credential is written to the MSI verbose log, emitted in MsiInstaller events in the Application Event Log, and exposed on the installer process command line while installation runs. Standard local users can read the Application Event Log and enumerate process command lines through Windows APIs such as WMI Win32_Process or Get-CimInstance. Once obtained, the OAuth client secret authorizes API calls to the Okta tenant as the Hyperdrive Integration, enabling data access scoped to that integration.

Root Cause

The root cause is improper handling of a sensitive MSI property. Windows Installer supports the MsiHiddenProperties mechanism, which prevents a property value from being written to logs or event records. The Okta Hyperdrive Integration installer omits the OAuth client secret from that list, so the credential is treated as an ordinary property and persisted in multiple log surfaces on the endpoint.

Attack Vector

Exploitation requires local, authenticated access to the workstation where the installer ran. The attacker reads %TEMP%\MSI*.log files, queries Application log entries with source MsiInstaller, or captures the installer process command line during execution. No user interaction is required beyond routine log or process enumeration. The credential recovered can then be used from any network location that reaches the Okta tenant, which is why the CVSS scope is marked as changed. See the Okta Security Advisory CVE-2026-78627 for vendor detail.

Detection Methods for CVE-2026-78627

Indicators of Compromise

Presence of MSI*.log files in %TEMP% or %WINDIR%\Installer containing OAuth client secret strings adjacent to Okta Hyperdrive property names
MsiInstaller events in the Windows Application Event Log referencing the Hyperdrive Integration installer with property values embedded in the message body
Process creation events (Sysmon Event ID 1 or Windows Event ID 4688) showing msiexec.exe command lines that include OAuth client secret parameters

Detection Strategies

Hunt across endpoint telemetry for msiexec.exe command lines containing property assignments associated with the Okta Hyperdrive Integration installer
Search log aggregation platforms for Application Event Log entries with source MsiInstaller that reference Hyperdrive property names
Alert on non-administrative local users reading installer log directories or querying Win32_Process for historical msiexec.exe invocations

Monitoring Recommendations

Ingest Windows Application and Security event logs into a centralized data lake and retain long enough to cover installer execution windows
Monitor Okta system logs for unexpected API activity attributed to the Hyperdrive Integration client, particularly from new source IP addresses
Track file access to %TEMP%\MSI*.log by unprivileged accounts and flag reads that occur after installation completes

How to Mitigate CVE-2026-78627

Immediate Actions Required

Rotate the OAuth client secret for every Okta Hyperdrive Integration whose installer has been executed on a workstation
Delete installer log files under %TEMP% and %WINDIR%\Installer that reference the Hyperdrive Integration installation
Clear or archive Application Event Log entries containing the plaintext OAuth client secret and restrict access to the archives
Review Okta system logs for unauthorized use of the affected client credential prior to rotation

Patch Information

Refer to the Okta Security Advisory CVE-2026-78627 for the fixed installer version and vendor guidance. Deploy the updated installer to all affected workstations and rotate credentials issued to prior installations.

Workarounds

Avoid passing the OAuth client secret as an MSI property on the command line; supply it after installation through the integration configuration interface where supported
Restrict installation of the Okta Hyperdrive Integration to accounts and endpoints where only administrators can read installer logs and Application Event Log entries
Disable verbose MSI logging during installation by omitting the /L*V option and clear any logs generated by prior installations

bash

# Configuration example: remove installer log artifacts and rotate the credential
# 1) Remove MSI installer logs that may contain the plaintext client secret
del /Q "%TEMP%\MSI*.log"

# 2) Clear the Windows Application Event Log after exporting for review
wevtutil epl Application C:\Backup\Application-pre-clear.evtx
wevtutil cl Application

# 3) In the Okta admin console, rotate the OAuth client secret for the
#    Hyperdrive Integration and update the integration configuration on
#    all workstations with the newly issued secret.