The Okta Hyperdrive Agent (version 1.4.0) logs the decoded SAML bearer assertion, which contains sensitive authentication information, to a local application log file at the default log level upon each successful MFA completion. This behavior results in the insertion of sensitive live authentication credentials into a log file accessible by local users, potentially allowing unauthorized access to these credentials. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact. The attack vector requires local access with low privileges and high attack complexity, and no user interaction is needed. The confidentiality impact is high, while integrity impact is low and availability is not affected. No official patch or remediation guidance has been provided yet.

The vulnerability allows any local user with access to the log file to read live authentication credentials (decoded SAML bearer assertions), which could lead to unauthorized access or credential theft. The impact on confidentiality is high due to exposure of sensitive authentication tokens. Integrity impact is low, and availability is unaffected. Exploitation requires local access with low privileges and is considered complex.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to log files containing sensitive information to trusted users only. Monitor for updates from Okta regarding an official fix or mitigation.