CVE-2026-78631

Executive Summary

CVE-2026-78631 is an information-disclosure vulnerability in the Okta Hyperdrive Agent in which the decoded SAML bearer assertion is written to a local application log file at the default log level upon every successful MFA completion. Because the logged assertion constitutes a live authentication credential, any local user with read access to that log file can recover a valid bearer token and impersonate the authenticated principal. The CVSS score of 5.3 reflects a local attack vector with high confidentiality impact; exploitation requires local log access and is not remotely exploitable, but the leaked material is an immediately reusable credential.

Technical Analysis

The vulnerability is an instance of CWE-532, "Insertion of Sensitive Information into Log File." The affected component is the Okta Hyperdrive Agent, which processes SAML bearer assertions as part of an MFA flow. According to the NVD description, the agent writes the decoded SAML bearer assertion into a local application log file. Critically, this insertion occurs at the default log level, meaning operators do not need to enable verbose or debug logging for the sensitive data to be persisted — the behavior is present in the normal, out-of-the-box operating state, and it happens on every successful MFA completion.

The exposure arises from the combination of two factors: the content written, and the access control boundary around where it is written. A decoded SAML bearer assertion is not a redacted identifier or an opaque hash; it is the credential material itself. Once present in cleartext within a local log file, it remains valid for the lifetime of the assertion and is usable by any party who can read the file. The trust boundary crossed here is local: the log file's filesystem permissions determine exposure, not the network perimeter.

The CVSS:3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N describes the scenario with precision. The attack vector is Local (AV:L), consistent with the requirement that the adversary already have reading access to the host's log file. Attack complexity is High (AC:H) — the attacker must obtain local file access, and the value of the captured assertion depends on timing relative to the assertion's validity window. Privileges Required is Low (PR:L), indicating a low-privileged local account suffices. No user interaction is required (UI:N). Scope is unchanged (S:U). Confidentiality impact is High (C:H) because the leaked artifact is a live credential. Integrity impact is Low (I:L), reflecting the potential for an attacker to act under the identity conveyed by the stolen assertion; availability impact is None (A:N).

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The description does not enumerate specific function names, log file paths, configuration keys, or API endpoints, and none are asserted here. The mechanism is understood at the vulnerability-class level: sensitive credential material written to a local log at default verbosity.

Exploitation Scenarios

No public PoC is available; the attack chain described below is inferred from the vulnerability class (CWE-532) and the NVD description.

1. Reconnaissance / target identification. The attacker establishes a foothold on, or obtains any degree of access to, a host running the Okta Hyperdrive Agent. This could be a shared multi-user system, a build or CI node, an administrative workstation, or any endpoint where the agent executes. The attacker enumerates for the agent's local application log files and determines whether their account holds read permission on them.

2. Triggering the flaw. This vulnerability requires no attacker-supplied input, no crafted request, and no malformed data. The condition is reached passively: the agent writes the decoded SAML bearer assertion to its log on every successful MFA completion, at the default log level. Accordingly, the trigger event is simply the legitimate authentication of any user through the MFA flow on that host. The attacker's role is to read the log file after — or continuously while — that write occurs.

3. Credential capture. The attacker reads the log file and extracts the decoded SAML bearer assertion. Where logs are rotated, shipped to a central collector, or included in backups, the attacker's reach extends to every location that copy has propagated to; capture is possible long after the log line was written if retention is long enough.

4. Post-exploitation impact. With a live bearer assertion in hand, the attacker presents it as a bearer credential to services that accept it, operating under the identity of the user whose MFA flow was logged. This yields unauthorized access to whatever that identity is entitled to, without knowledge of the victim's password and without re-triggering an MFA challenge. Integrity impact is rated Low rather than High because the stolen assertion is bounded by its validity lifetime and by the privileges of the impersonated principal; volume of impact scales with the number and privilege level of log lines the attacker can harvest.

Impact Assessment

Successful exploitation yields a live authentication credential to any local user able to read the agent's log file. The blast radius is defined by two variables: how many principals authenticate through the affected host, and how privileged those principals are. On shared or administrative hosts, a low-privileged local user can accumulate assertions for more privileged identities over time.

Business impact centers on unauthorized access and lateral movement under legitimate identities. Because the stolen artifact is a valid credential rather than a forgery, downstream authentication logs will show successful, seemingly legitimate sessions — degrading the value of authentication telemetry for detection. The CVSS subscores quantify the trade-off: High confidentiality impact (C:H) from credential exposure, Low integrity impact (I:L) from impersonation bounded by the assertion's lifetime, and no availability impact (A:N). The EPSS score of 0.00100 (0.9th percentile) reflects no observed exploitation in the wild, and the CVE is not in the CISA KEV catalog — the threat is conditional on an attacker first obtaining local read access to the log file.

Detection Guidance

Sigma Rule

title: Potential SAML Bearer Assertion Exposure via Okta Hyperdrive Agent Log Access
id: 7f3c9a12-4b6e-4d21-9a8f-2c1e5d7b6a04
status: experimental
description: Detects local access to Okta Hyperdrive Agent application log files, which may contain decoded SAML bearer assertions written at the default log level (CVE-2026-78631).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78631
author: valtersit.com
date: 2026-01-01
logsource:
  category: file_access
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - 'hyperdrive'
      - 'okta'
    TargetFilename|endswith:
      - '.log'
  selection_action:
    EventType: 'Read'
  filter_system:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Program Files\Okta\'
  condition: selection_path and selection_action and not filter_system
falsepositives:
  - Administrative log review and log-shipping agents
  - Endpoint backup and indexing software
level: medium
tags:
  - attack.credential_access
  - attack.t1552

YARA Rule

rule CVE_2026_78631_SAML_Assertion_In_Log
{
    meta:
        author = "valtersit.com"
        description = "Detects decoded SAML bearer assertions persisted in Okta Hyperdrive Agent log files (CVE-2026-78631)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78631"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $saml1 = "SAMLResponse" ascii wide nocase
        $saml2 = "saml:Assertion" ascii wide nocase
        $saml3 = "Bearer" ascii wide nocase
        $saml4 = "<Assertion" ascii wide nocase
        $cond1 = "NotOnOrAfter" ascii wide nocase
        $cond2 = "Conditions" ascii wide nocase
        $nameid = "NameID" ascii wide nocase

    condition:
        filesize < 50MB and
        (2 of ($saml*)) and
        (1 of ($cond*)) and
        $nameid
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78631 Potential SAML Bearer Assertion Transmitted in Cleartext"; flow:established,to_server; http.header_names; content:"Authorization"; nocase; content:"Bearer "; nocase; http.header; pcre:"/Authorization\x3a\s*Bearer\s+[A-Za-z0-9_\-\.=]{40,}/i"; threshold:type limit, track by_src, count 1, seconds 60; classtype:credential-theft; reference:cve,2026-78631; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78631; sid:202678631; rev:1;)

Elastic Detection

file where file.path : ("*hyperdrive*" or "*okta*") and file.extension == "log"
  and event.action == "read"
  and not process.name in ("logrotate", "rsyslogd", "filebeat", "fluentd", "splunkd", "td-agent")

Splunk SPL Query

index=endpoint (source="*hyperdrive*.log" OR source="*okta*.log")
| rex field=_raw "(?i)(?<saml_artifact><(?:saml:)?Assertion|SAMLResponse|Bearer\s+[A-Za-z0-9_\-\.=]{40,})"
| where isnotnull(saml_artifact)
| stats count min(_time) as first_seen max(_time) as last_seen by host, source, user
| sort - count

Wazuh OSSEC Rule

<group name="okta,hyperdrive,cve-2026-78631,">
  <rule id="202678" level="10">
    <decoded_as>json</decoded_as>
    <field name="path">hyperdrive</field>
    <regex type="pcre2">(?i)(SAMLResponse|saml:Assertion|Bearer\s+[A-Za-z0-9_\-\.=]{40,})</regex>
    <description>CVE-2026-78631: Possible SAML bearer assertion exposed in Okta Hyperdrive Agent log</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). No vendor advisory, fixed version number, or commit reference is available in the provided data, and no vendor workarounds are documented.

1. Immediate mitigations (no confirmed patch required): treat every Okta Hyperdrive Agent application log file as credential material. Restrict filesystem permissions on the log directory so that only the service account and explicitly authorized administrators can read it, and verify that log file permissions inherit correctly on rotation. Aggressively reduce log retention for the agent's log and ensure logs are not copied to world-readable backup or archive tiers without the same access restrictions. Where the agent's logging level is configurable, lower verbosity — although note the exposure occurs at the default log level, so verbosity reduction alone is not a reliable control. Identify and revoke any bearer assertions believed to have been written to an accessible log.

2. Patch/upgrade steps: no confirmed fixed version is documented. Verify the patched status directly with Okta — through the Okta Trust Center, vendor advisories, or support — before assuming a given release resolves the issue, since the patch signal is a single unconfirmed source (NVD). Where the vendor has issued a fix, upgrade the Hyperdrive Agent to the corrected release and confirm that the decoded assertion is no longer written to local logs at default verbosity. Invalidate credentials that passed through affected versions.

3. Long-term hardening: classify log output as a data-handling boundary and apply secret-scrubbing at the logging layer so credential material cannot be emitted even if application code handles it. Centralize agent logs to an access-controlled collector rather than leaving them on multi-user endpoints. Monitor for anomalous reads of the agent's log files, and integrate the detection rules above into SOC coverage. Include assertion-lifetime reduction as a defense-in-depth measure to cap the window in which any leaked credential remains valid.

References

• NVD — CVE-2026-78631: https://nvd.nist.gov/vuln/detail/CVE-2026-78631
• CWE-532: Insertion of Sensitive Information into Log File — https://cwe.mitre.org/data/definitions/532.html
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-78631 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Okta Trust Center / vendor security advisories (verify patch status directly; no advisory confirmed in available data): https://trust.okta.com/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-78631 in the available data. EPSS is 0.00100 (0.9th percentile), and the CVE is not in the CISA KEV catalog.