The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. Consequently, the secret is recorded in plaintext in multiple locations including the installer log, Application Event Log, and the process command line. These logs and command line details are accessible to authenticated local users on the affected workstation, leading to potential credential disclosure. The vulnerability affects version 1.2.0 of the plugin. No official patch or remediation level has been provided by the vendor as of the published date.

The vulnerability allows an authenticated local user to obtain the OAuth client secret by reading installer logs, event logs, or process command line arguments. This could lead to unauthorized access or misuse of the OAuth credentials, compromising confidentiality. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit local user access on workstations where the Okta Hyperdrive Integration Plugin is installed to trusted personnel only. Avoid running the installer in environments where untrusted users have local access. Monitor vendor communications for updates or patches addressing this issue.