CVE-2026-78574: Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling
The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the context of the host process or elevated installer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Okta Hyperdrive Integration pluginto a version that resolves this vulnerability.Fixed in 1.5.2
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs local access with low-privileged access to the affected user's registry hive, along with the ability to control the assembly path referenced there. Exploitation does not require user interaction.
When is the impact most serious?
Impact is most serious when the affected plugin or an installer loads the registry-referenced assembly in an elevated context. The unverified assembly can then execute with the privileges of the host process or elevated installer.
What condition should defenders investigate to identify exposure?
Investigate the current user's registry entries used by the Okta Hyperdrive Integration Plugin for required assembly resolution. A registry-controlled path that is loaded through Assembly.LoadFrom without integrity or signature validation indicates the exposed behavior.