CVE-2026-78629

MediumCVSS 5.5/10Last modified Sep 22, 2026

Description

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-303

Affected software

Vendor	Product	Versions
Okta	Okta Hyperdrive Agent	>= 1.2.0, < 1.5.2

References

https://trust.okta.com/security-advisories/improper-authentication-verification-in-the-okta-hyperdrive-agent-mfa-response-handling-cve-2026-78629Vendor Advisory

Timeline

Published: Sep 8, 2026
Last modified: Sep 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-78638.4Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technolo CVE-2026-786306.7The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to constr CVE-2026-786315.5The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every success CVE-2026-786325.3The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on th CVE-2026-786336.5The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero ca CVE-2026-786355.0The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arg CVE-2026-786364.3IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe cla CVE-2026-786377.3A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pd CVE-2026-786383.3A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the co CVE-2026-78646.9SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA CVE-2026-78657.4A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party CVE-2026-786547.3A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src