Read the docs
TI-2026-54675 Aliases CVE-2026-78629GHSA-p4wq-g97j-pcf5

Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling

Priority LOW 24CWE-303Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0014 3rd percentileScored 2026-11-07
Fix Fixed Okta Hyperdrive Agent (Okta): 1.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OktaOkta Hyperdrive Agent1.2.0 to before 1.5.21.5.2Patch availableCNA
  • Okta Hyperdrive Agent VendorOkta Affected 1.2.0 to before 1.5.2 Fixed in 1.5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:okta:hyperdrive:*:*:*:*:*:*:*:*1.2.0 to before 1.5.2VulnerableOkta
  • cpe:2.3:a:okta:hyperdrive:*:*:*:*:*:*:*:* Versions 1.2.0 to before 1.5.2 Vulnerable ·Okta

Remediation

  • Fix · CNA Okta Hyperdrive Agent (Okta) Fixed in 1.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Okta Hyperdrive Agent 1.5.2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-54677 Improper Restriction of Sensitive Information in Okta Hyperdrive Agent LoggingPriority LOW 24
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-78629
  2. 2026-10-03 Alias added: GHSA-p4wq-g97j-pcf5

References

Advisory 1

  • TI-2026-54627 Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling CVSS 3.1HIGH 7.5
  • TI-2026-54674 Improper Credential Protection in Okta Hyperdrive Integration Installer Logging CVSS 3.1HIGH 7.3
  • TI-2026-54677 Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences