CVE-2026-78627: Insertion of Sensitive Information into Log File in Okta Okta Hyperdrive Integration Plugin

The Okta Hyperdrive Integration installer fails to mask the OAuth client secret when passed as an MSI property, resulting in the secret being recorded in plaintext in multiple locations including the installer log, Application Event Log, and process command line. These logs and command line details are accessible to authenticated local users on the affected workstation, potentially exposing sensitive credentials. The vulnerability affects versions >=1.2.0 and <1.5.2, including version 1.2.0 specifically.

Exposure of the OAuth client secret in plaintext to authenticated local users can lead to credential compromise, potentially allowing unauthorized access to OAuth-protected resources or services. The vulnerability does not affect confidentiality of the system beyond the local authenticated user scope and does not impact availability. The CVSS score of 7.3 reflects high confidentiality impact with limited integrity and no availability impact.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local user access to affected workstations and avoid passing sensitive credentials as MSI properties in the installer.