Quick answers
- Is CVE-2026-78631 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78631 being exploited in the wild.
- How severe is CVE-2026-78631?
- Medium severity, with a CVSS score of 5.3, published 8 September 2026.
- Which products and versions are affected?
- Okta Hyperdrive agent 1.4.0 through 1.5.1.
- Is there a fix for CVE-2026-78631?
- A patch was published on 2026-09-08: Version 1.5.2 and later resolve the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78631 attacked?
- It is attacked with local access, in a hosted service.
- Am I affected by CVE-2026-78631?
- Check whether you run Okta Hyperdrive or Okta Hyperdrive agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a sensitive information exposure issue (CWE-532) where the Okta Hyperdrive Agent logs decoded SAML bearer assertions at default log level after every successful MFA completion. The root cause is improper restriction of log file contents; the sensitive authentication tokens are written without redaction or restricted permissions. Attack requires local file system access to read application logs—a local privilege or adjacent-network scenario depending on system configuration. An attacker can extract live authentication credentials from the plaintext log file and use them to authenticate as the targeted user. The vulnerability affects versions 1.4.0 through 1.5.1 and is fixed in version 1.5.2 and later.
Affected products
- Okta Hyperdrive Agent 1.4.0 through 1.5.1
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Version 1.5.2 and later resolve the issue