EUVD-2026-74183
GHSA-7x42-7j3m-qc6m
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
AV:L and PR:L reflect local log file access requirement; AC:L because assertion is logged persistently on every MFA completion, not a race condition.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
4DescriptionCVE.org
The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.
AnalysisAI
Credential exposure in Okta Hyperdrive Agent versions 1.4.0 through 1.5.1 allows any local user with log file read access to obtain live SAML bearer assertions logged in cleartext on every successful MFA completion. Because SAML bearer assertions function as authentication credentials, a local attacker can replay them to authenticate as the victim user to any service provider trusting the Okta identity provider. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local OS account on the host running Okta Hyperdrive Agent with read access to the agent's application log file, and the agent must be operating at the default log level (which triggers assertion logging). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N scores this at 5.3 Medium. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Okta Hyperdrive Agent 1.5.2 or later, which resolves the logging behavior per the vendor advisory at https://trust.okta.com/security-advisories/improper-restriction-of-sensitive-information-in-okta-hyperdrive-agent-logging-cve-2026-78631. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today