CVE-2026-78629
Medium
Description
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.
SeverityMedium
CVSS5.6
Exploit probability—
Product
Okta Hyperdrive
PublishedSep 8, 2026
First seenSep 8, 2026
Weakness typeCWE-303CWE-303
How to fix
Update
- okta hyperdrive1.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| okta hyperdrive | 1.2.0 ≤ v < 1.5.2 | 1.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.