Executive brief
Okta's Hyperdrive Agent, a multi-factor authentication component, writes decoded authentication credentials to local application log files accessible by any user on the system. An attacker with local access to the affected machine can read these log files to obtain live MFA bearer tokens and impersonate authenticated users, bypassing multi-factor authentication controls.
Technical details
The vulnerability is a sensitive information exposure issue (CWE-532) where the Okta Hyperdrive Agent logs decoded SAML bearer assertions at default log level after every successful MFA completion. The root cause is improper restriction of log file contents; the sensitive authentication tokens are written without redaction or restricted permissions. Attack requires local file system access to read application logs—a local privilege or adjacent-network scenario depending on system configuration. An attacker can extract live authentication credentials from the plaintext log file and use them to authenticate as the targeted user. The vulnerability affects versions 1.4.0 through 1.5.1 and is fixed in version 1.5.2 and later.
Affected products
- Okta Hyperdrive Agent 1.4.0 through 1.5.1
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Version 1.5.2 and later resolve the issue