CVE-2026-78631: Okta Hyperdrive Agent Information Disclosure

CVE-2026-78631 Overview

CVE-2026-78631 is an information disclosure vulnerability in the Okta Hyperdrive Agent. The agent writes decoded Security Assertion Markup Language (SAML) bearer assertions to a local application log file at the default log level on every successful Multi-Factor Authentication (MFA) completion. Any local user with read access to the log file can retrieve a live authentication credential. The flaw is categorized under [CWE-532] Insertion of Sensitive Information into Log File. Exploitation requires local access and low privileges, and the attack complexity is high because an adversary must capture and replay the assertion within its validity window.

Critical Impact
A local user with read access to the Hyperdrive Agent log file can extract valid SAML bearer assertions and impersonate authenticated users to downstream services.

Affected Products

Okta Hyperdrive Agent

Discovery Timeline

2026-09-08 - CVE-2026-78631 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78631

Vulnerability Analysis

The Okta Hyperdrive Agent handles SAML bearer assertions as part of federated authentication flows tied to MFA completion. On every successful MFA event, the agent decodes the SAML assertion and writes the plaintext contents to its local application log file. Logging occurs at the default verbosity, so no elevated debug flag is required to trigger the disclosure. A SAML bearer assertion is a live credential; anyone who possesses it can present it to a relying party and authenticate as the subject until the assertion expires. The exposure converts routine log access into a credential theft opportunity.

Root Cause

The root cause is improper restriction of sensitive information written to log output. The agent does not redact, mask, or omit the decoded assertion prior to invoking the logger. Combined with default log-level emission, the sensitive content is written on every successful authentication rather than only under diagnostic conditions.

Attack Vector

An attacker requires local access to the host running the Okta Hyperdrive Agent and read permissions on the agent's log file. The attacker parses the log for SAML assertions, extracts a valid unexpired assertion, and replays it against the relying service to gain the victim's authenticated session. Attack complexity is high because the attacker must obtain the assertion within its validity window and successfully replay it before it expires. Refer to the Okta Security Advisory CVE-2026-78631 for vendor-supplied technical details.

Detection Methods for CVE-2026-78631

Indicators of Compromise

Presence of decoded SAML assertion XML (elements such as <saml:Assertion>, <saml:Subject>, or <saml:AuthnStatement>) inside Okta Hyperdrive Agent log files.
Unexpected read access to Hyperdrive Agent log directories by non-administrative local users or service accounts.
Authentication events at the Identity Provider (IdP) or relying party originating from hosts or sessions that do not match the legitimate user's device fingerprint.

Detection Strategies

Scan Hyperdrive Agent log files for SAML assertion markers and alert when matches are found on production endpoints.
Correlate file-access telemetry against the Hyperdrive log path to identify processes or users reading logs outside of expected support workflows.
Monitor federated authentication activity for reused assertion identifiers or geographically improbable session establishment.

Monitoring Recommendations

Enable file integrity and access auditing on the Okta Hyperdrive Agent log directory.
Forward endpoint log-access events and IdP authentication events to a central analytics platform for cross-source correlation.
Alert on any privilege changes or Access Control List (ACL) modifications applied to the agent log files.

How to Mitigate CVE-2026-78631

Immediate Actions Required

Apply the fixed version of the Okta Hyperdrive Agent as identified in the Okta Security Advisory CVE-2026-78631.
Rotate or invalidate any user sessions established during the exposure window if logs were accessible to untrusted local users.
Review and restrict permissions on the Hyperdrive Agent log directory so only the service account and administrators can read the files.

Patch Information

Okta has issued a security advisory tracking CVE-2026-78631. Consult the Okta Security Advisory CVE-2026-78631 for the fixed agent version and upgrade guidance specific to your deployment.

Workarounds

Harden Access Control Lists on the Hyperdrive log directory to remove read access for standard users.
Redirect or truncate existing logs that contain decoded SAML assertions, and purge historical archives from backup systems.
Where supported, lower or reconfigure agent logging to suppress authentication payload content until the patched version is deployed.

bash

# Example: restrict read access on the Hyperdrive Agent log directory (Windows)
icacls "C:\ProgramData\Okta\HyperdriveAgent\logs" /inheritance:r
icacls "C:\ProgramData\Okta\HyperdriveAgent\logs" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"

# Example: restrict read access on Linux deployments
chown -R root:okta /var/log/okta/hyperdrive
chmod -R 750 /var/log/okta/hyperdrive