CVE-2026-78629: Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Okta Hyperdrive agentto a version that resolves this vulnerability.Fixed in 1.5.2
Event History
Frequently Asked Questions
What configuration condition triggers the unverifiable response?
The condition occurs when the organization's policy requires no MFA for a given user. In that case, the agent plugin returns a success response with only a bare boolean validation indicator rather than a signed SAML assertion.
What would an attacker need in order to exploit this issue?
The provided CVSS vector indicates local access, high attack complexity, and low privileges are required. No user interaction is required.
What security impact is identified?
The vulnerability can affect integrity, while confidentiality and availability are not identified as affected in the supplied CVSS vector. The scope is marked as changed.