EUVD-2026-74176
GHSA-mm4c-wvrq-74qm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Local read access with low privileges suffices; scope changes because leaked OAuth secret enables access to Okta cloud services beyond the local host.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
4DescriptionCVE.org
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation.
AnalysisAI
Credential leakage in the Okta Hyperdrive Integration installer (versions 1.2.0 through 1.5.1) exposes the OAuth client secret in plaintext across three Windows logging surfaces - the MSI installer log, the Windows Application Event Log, and the process command line - whenever the secret is supplied as an MSI property at install time. An authenticated local user on the workstation can read any of these surfaces and extract the credential without elevated privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local user account on the Windows workstation where the Okta Hyperdrive Integration installer (versions 1.2.0-1.5.1) was executed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N (7.3) is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Okta Hyperdrive Integration Plugin 1.5.2 or later, which is confirmed available per the Okta vendor advisory at https://trust.okta.com/security-advisories/improper-credential-protection-in-okta-hyperdrive-integration-installer-logging-cve-2026-78627. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows systems with Okta Hyperdrive Integration versions 1.2.0-1.5.1 and immediately rotate all OAuth client secrets associated with affected installations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today