CVE-2026-78627 Improper Credential Protection in Okta Hyperdrive Integration Installer Logging

High 7.3 Published 8 Sep 2026 Updated 10 Sep 2026

An authenticated local user can read plaintext OAuth client secrets from installer logs and process command lines in Okta Hyperdrive Integration.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-78627?

CVE-2026-78627 is a high-severity vulnerability in Okta Hyperdrive Integration Plugin, published on 8 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation.

Weakness: CWE-532

Which versions are affected by CVE-2026-78627?

It affects 1 product.

Products include Okta Hyperdrive.

How do I fix CVE-2026-78627?

No fix has been published for CVE-2026-78627 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-78627 being exploited?

There is no known exploitation of CVE-2026-78627 in the wild and no public exploit code.

Sources

Also known as GHSA-mm4c-wvrq-74qm.