CVE-2026-78629

Analyzed Analyzed - Analysis Complete

SAML Assertion Missing in Okta Hyperdrive Agent Plugin

Publication date: 2026-09-08

Last updated on: 2026-09-22

Assigner: Okta

Description

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-22

Generated

2026-09-30

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-78629

Affected Vendors & Products

Vendor	Product	Version / Range
okta	hyperdrive	From 1.2.0 (inc) to 1.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-303	The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Attack-Flow Graph

Executive Summary

CVE-2026-78629 is an improper authentication verification flaw in the Okta Hyperdrive agent plugin. When an organization's policy skips MFA for a user, the plugin returns a success response without a signed SAML assertion. Instead, it only includes a boolean validation indicator, making the authentication unverifiable for the relying application.

Impact Analysis

This vulnerability could allow attackers to bypass authentication checks when MFA is not enforced. Since the response lacks a cryptographic artifact, relying applications cannot verify the legitimacy of the authentication, potentially granting unauthorized access to systems or data.

Compliance Impact

This vulnerability may violate compliance requirements that mandate strong authentication and auditability, such as GDPR's data protection principles or HIPAA's access controls. Unverified authentication could lead to unauthorized data access, triggering non-compliance penalties or breaches of regulatory standards.

Mitigation Strategies

Upgrade the Okta Hyperdrive agent plugin to version 1.5.2 or later to resolve the improper authentication verification issue.

Hi! I’m here to help you understand CVE-2026-78629. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70