CVE-2026-78631

Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This improper restriction of sensitive information makes a live authentication credential readable by any local user with access to that log ...

CVE-2026-78574

CVE-2026-78574 affects the Okta Hyperdrive Integration plugin , which resolves a required assembly via a registry path in the current user's hive without integrity verification. The assembly is loaded through Assembly.LoadFrom without signature validation, allowing an unverified assembly to execu...

CVE-2026-78629

The Okta Hyperdrive agent plugin contains an improper authentication verification flaw in its MFA response handling. When an organization's policy does not require MFA for a given user, the plugin returns a success response that contains only a bare boolean validation indicator rather than a sign...

CVE-2026-78627

Okta Hyperdrive Integration installer exposes the OAuth client secret in plaintext when it is passed as an MSI property. The credential is recorded in three locations readable by an authenticated local user: the installer log , the Application Event Log , and the process command line . The CVSS 3...