CVE-2026-78627

Executive Summary

CVE-2026-78627 is an information disclosure vulnerability in the Okta Hyperdrive Integration installer that fails to mask the OAuth client secret when the credential is supplied as an MSI property. As a result, the secret is written in plaintext to the installer log, the Windows Application Event Log, and the process command line, any of which is readable by an authenticated local user on the affected workstation. The vulnerability has a CVSS v3.1 base score of 7.3 (High), reflecting local attack vector, low privileges required, and high confidentiality impact; no public proof-of-concept, Nuclei template, or CISA KEV listing is currently associated with it.

Technical Analysis

The vulnerability class is CWE-532: Insertion of Sensitive Information into Log File. The affected component is the Okta Hyperdrive Integration installer, which processes configuration input via MSI properties — the standard mechanism for passing parameters to Windows Installer packages (for example, during silent or unattended installation). When the OAuth client secret is supplied this way, the installer does not mask or redact it.

Three distinct disclosure channels are described:

1. Installer log — Windows Installer (MSI) executions generate logs that, in verbose form, record the properties and command lines used during installation. If the secret is passed as an MSI property and the installer does not explicitly mask it, the plaintext value persists in that log file on disk.
2. Application Event Log — The installer writes telemetry or diagnostics to the Windows Application Event Log; the unmasked secret is recorded there as well, making it retrievable through standard event log readers.
3. Process command line — MSI properties are commonly passed as command-line arguments to msiexec. On Windows, process command lines are visible to local users through supported mechanisms such as WMI (Win32_Process.CommandLine) and certain process inspection APIs. Because the secret is included verbatim in the argument string, it is exposed for the lifetime of the process and potentially captured by auditing or endpoint telemetry that records process creation events.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N is notable for its Scope:Changed (S:C) designation and High confidentiality (C:H) impact. Scope change indicates that the vulnerable installer component can affect resources beyond its own security authority — in this case, the disclosed secret grants access to Okta-integrated resources outside the workstation boundary. The low integrity impact (I:L) follows from the credential providing a limited, scoped ability to alter integration behavior rather than full system compromise. No user interaction is required: any authenticated local user on the workstation can obtain the credential from one of the three disclosure channels without inducing any action by an administrator.

No further implementation-level detail — such as specific property names, log file paths, or event IDs — is available in the supplied NVD description, and none is fabricated here.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly from the vulnerability class (CWE-532) and the disclosure surfaces named in the NVD description.

1. Reconnaissance / target identification. An adversary with authenticated local access to a workstation where the Okta Hyperdrive Integration was installed using an MSI property for the OAuth client secret first determines whether that installation method was used. Indicators include the presence of the Okta Hyperdrive Integration software on the host and access to the installer's log output or the host's Application Event Log. No remote reconnaissance is needed; the attacker operates from the local session.

2. Triggering the flaw class. The vulnerability is a static information-disclosure condition — it is triggered at install time, not by attacker action. The attacker simply reads the already-recorded plaintext secret from one of the three named channels: the installer log, the Application Event Log, or the process command line (during or via retained process/telemetry records). This requires only the privileges of an ordinary authenticated local user.

3. Credential extraction. The adversary extracts the OAuth client secret as a plaintext string. Because the secret authenticates the Okta Hyperdrive Integration to Okta, it is directly reusable — no cracking, decryption, or brute force is required.

4. Post-exploitation impact. Possession of the OAuth client secret allows the attacker to impersonate the Hyperdrive Integration to Okta and exercise the integration's granted permissions. Depending on the scopes assigned, this can enable unauthorized access to or modification of the resources the integration is entitled to reach (consistent with High confidentiality and Low integrity impact, and the Scope:Changed rating). Because the credential is a service-style secret rather than a user password, detection via normal user-behavior analytics is more difficult, and the exposure is not bound to the compromised workstation alone.

The absence of a public exploit and the local-only attack vector mean this is primarily an insider-risk and post-compromise lateral/privilege concern rather than a remote mass-exploitation threat.

Impact Assessment

• Confidentiality (High): The OAuth client secret is disclosed in plaintext, exposing the full value of the credential the integration uses to authenticate to Okta.
• Integrity (Low): The leaked credential can be used to alter integration behavior within its granted scope.
• Availability (None): No direct denial-of-service component is described.
• Scope (Changed): Compromise of the workstation-local installer component yields access to resources beyond the workstation — the Okta-integrated environment — which is why the score is elevated to 7.3 despite the local vector.
• Blast radius: Every workstation where the Hyperdrive Integration was installed with the secret passed as an MSI property, and by extension every Okta tenant/resource that the integration is authorized to reach. Because installation may have occurred across a fleet via automation, multiple endpoints could each hold a copy of the same or related secrets.
• Business impact: Potential unauthorized access to integrated Okta services, credential rotation overhead, compliance exposure (secrets in logs violates common audit and logging hygiene controls), and possible downstream data access depending on granted scopes.
• Exploitability real-world: EPSS 0.00105 (low) and no KEV listing suggest limited observed exploitation, but the low skill barrier for a local user to read logs means targeted/insider exploitation remains plausible.

Detection Guidance

Sigma Rule

title: Okta Hyperdrive Installer Exposes OAuth Client Secret in Command Line
id: 6f1c9a3e-2b7d-4c8a-9e5f-0d3b8a1c7e42
status: experimental
description: Detects msiexec invocation carrying OAuth/client-secret style MSI properties, consistent with CVE-2026-78627 plaintext secret exposure.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78627
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\msiexec.exe'
  selection_prop:
    CommandLine|contains:
      - 'CLIENTSECRET'
      - 'CLIENT_SECRET'
      - 'OAUTH'
      - 'SECRET='
      - 'PASSWORD='
  condition: selection_img and selection_prop
falsepositives:
  - Legitimate administrative installs using secret-bearing MSI properties (should still be remediated)
level: high
tags:
  - attack.credential_access
  - attack.t1552

YARA Rule

rule CVE_2026_78627_OktaHyperdrive_SecretInLog
{
    meta:
        description = "Detects plaintext OAuth client secret material in Okta Hyperdrive installer logs and MSI logs"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78627"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "high"
    strings:
        $a = "Hyperdrive" nocase
        $b1 = "client_secret" nocase
        $b2 = "clients" nocase
        $b3 = "oauth" nocase
        $c1 = "SECRET=" nocase
        $c2 = "CLIENTSECRET" nocase
        $c3 = "PASSWORD=" nocase
    condition:
        $a and any of ($b*) and any of ($c*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78627 Okta Hyperdrive OAuth Client Secret in Transit (Potential Use of Leaked Credential)"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Authorization"; nocase; http.header; content:"Basic"; nocase; content:"okta"; nocase; http.uri; content:"/oauth2"; nocase; threshold: type limit, track by_src, count 1, seconds 60; classtype:credential-theft; reference:cve,2026-78627; sid:202678627; rev:1;)

Elastic Detection

process where process.name == "msiexec.exe" and
  process.command_line : ("*CLIENTSECRET*", "*CLIENT_SECRET*", "*OAUTH*", "*SECRET=*", "*PASSWORD=*")

Splunk SPL Query

index=windows (EventCode=4688 OR EventCode=1040 OR source="WinEventLog:Application")
| search (process_name="msiexec.exe" AND (CommandLine="*SECRET=*" OR CommandLine="*CLIENTSECRET*" OR CommandLine="*CLIENT_SECRET*"))
    OR (EventCode=1040 AND Message="*client_secret*")
    OR (source="WinEventLog:Application" AND Message="*Hyperdrive*" AND Message="*secret*")
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, process_name, CommandLine, Message
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="windows,cve-2026-78627,credential_disclosure,">
  <rule id="202678627" level="12">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.commandLine">SECRET=|CLIENTSECRET|CLIENT_SECRET|PASSWORD=</field>
    <field name="win.eventdata.image">msiexec.exe</field>
    <description>CVE-2026-78627: Possible OAuth client secret exposed on msiexec command line (Okta Hyperdrive installer)</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
  <rule id="202678628" level="12">
    <if_sid>60000</if_sid>
    <field name="win.system.providerName">Application</field>
    <match>Hyperdrive</match>
    <regex>client_secret|CLIENTSECRET|SECRET=</regex>
    <description>CVE-2026-78627: Plaintext OAuth secret recorded in Application Event Log (Okta Hyperdrive)</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — a single source, NVD, claims a patch exists; this is not independently confirmed, and no specific patched version or advisory was identified).

1) Immediate mitigations (until a verified patch is applied):

• Do not pass OAuth client secrets as MSI properties during Hyperdrive Integration installation. If the installer supports alternate secret entry (interactive prompt, environment-sourced or out-of-band secret provisioning), use it.
• Where installs have already occurred, treat the affected OAuth client secret as compromised: rotate the client secret in Okta immediately and invalidate the old credential.
• Scrub plaintext secrets from existing installer logs and the Windows Application Event Log on affected hosts; restrict log-file and Event Log read permissions to the minimum necessary principals.
• Reduce the exposure window on the process command line by ensuring process-creation auditing and EDR do not persist full command lines containing secrets; where possible, avoid command-line secret passing entirely.
• Restrict who holds local authenticated access to Hyperdrive-integration workstations.

2) Patch/upgrade steps:

• Confirm with Okta whether a fixed Hyperdrive Integration installer version exists; the NVD-sourced claim of a patch is unverified. Reference only versions explicitly published by Okta.
• Once a masked-installer build is confirmed, redeploy the Hyperdrive Integration to all endpoints that installed the prior build, then rotate any secret that was passed as an MSI property before the fix.

3) Long-term hardening:

• Adopt a secrets-management practice (vault/secret store) for OAuth client secrets; never place service credentials in installer properties, command lines, or logs.
• Enforce log-hygiene and secret-redaction standards in installer and application logging (remediate the CWE-532 class systemically).
• Monitor process command lines and Application Event Logs for secret-shaped values as a standing control.

References

1. NIST National Vulnerability Database — CVE-2026-78627: https://nvd.nist.gov/vuln/detail/CVE-2026-78627
2. MITRE CWE-532 — Insertion of Sensitive Information into Log File: https://cwe.mitre.org/data/definitions/532.html
3. MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
4. FIRST — CVSS v3.1 Specification (vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N): https://www.first.org/cvss/v3.1/specification-document
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-78627 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or threat-actor campaign has been observed or reported for CVE-2026-78627 based on the available intelligence.