{"id":"CVE-2026-78627","state":"PUBLISHED","title":"Improper Credential Protection in Okta Hyperdrive Integration Installer Logging","description":"The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation.","publishedAt":"2026-09-08T20:12:16.468Z","updatedAt":"2026-09-10T14:37:14.625Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","source":"Okta"},"assigner":"Okta","products":["Okta Okta Hyperdrive Integration Plugin"],"affected":[{"vendor":"Okta","product":"Okta Hyperdrive Integration Plugin","defaultStatus":"unaffected","versions":[{"version":"1.2.0","status":"affected","lessThan":"1.5.2","versionType":"semver"}]}],"references":["https://trust.okta.com/security-advisories/improper-credential-protection-in-okta-hyperdrive-integration-installer-logging-cve-2026-78627"],"weaknesses":["CWE-532"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/78xxx/CVE-2026-78627.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-78627","state":"PUBLISHED","datePublished":"2026-09-08T20:12:16.468Z","dateUpdated":"2026-09-10T14:37:14.625Z","assignerShortName":"Okta","assignerOrgId":"59b22baa-87b2-4371-8e4a-e080df12f74a","dateReserved":"2026-08-24T22:04:00.475Z"},"containers":{"cna":{"title":"Improper Credential Protection in Okta Hyperdrive Integration Installer Logging","descriptions":[{"lang":"en","value":"The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation."}],"affected":[{"vendor":"Okta","product":"Okta Hyperdrive Integration Plugin","defaultStatus":"unaffected","versions":[{"version":"1.2.0","status":"affected","lessThan":"1.5.2","versionType":"semver"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-credential-protection-in-okta-hyperdrive-integration-installer-logging-cve-2026-78627"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-532","lang":"en","description":"Insertion of Sensitive Information into Log File"}]}],"providerMetadata":{"shortName":"Okta","orgId":"59b22baa-87b2-4371-8e4a-e080df12f74a","dateUpdated":"2026-09-08T20:12:16.468Z"},"solutions":[{"lang":"en","value":"Upgrade the Okta Hyperdrive Integration plugin to version 1.5.2 or greater."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-10T14:37:05.638378Z","id":"CVE-2026-78627","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-10T14:37:14.625Z"}}]}}}