CVE-2026-78629— Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
Quick assessment
Affected
Okta Okta Hyperdrive Agent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当组织的策略要求某用户无需多因素认证（MFA）时，Okta Hyperdrive agent 插件会返回一个成功响应，但该响应中不包含签名的 SAML 断言。此响应仅包含一个裸布尔验证指示器，缺乏任何加密工件，导致无法验证的认证结果被传递给依赖方应用。
Possible ATT&CK Techniques 1 AI
T1585 · Establish Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78629
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
Source: CVE Program / CVE List V5
Vulnerability Description
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证算法的不正确实现
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Okta | Okta Hyperdrive Agent | 1.2.0 ~ 1.5.2 | - |
|
II. Public POCs for CVE-2026-78629
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78629
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78629 (1)
Same Patch Batch · Okta · 2026-09-08 · 17 CVEs total
| CVE-2026-78626 | 8.1 HIGH | Improper Input Sanitization in Okta Access Gateway Protected Rules |
| CVE-2026-78623 | 7.7 HIGH | Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datast |
| CVE-2026-78574 | 7.5 HIGH | Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling |
| CVE-2026-78627 | 7.3 HIGH | Improper Credential Protection in Okta Hyperdrive Integration Installer Logging |
| CVE-2026-78579 | 6.8 MEDIUM | Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation |
| CVE-2026-78625 | 6.7 MEDIUM | Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard S |
| CVE-2026-78630 | 6.7 MEDIUM | Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing |
| CVE-2026-78550 | 6.6 MEDIUM | Improper Input Handling in Okta Access Gateway Management Console Exception Handler |
| CVE-2026-78545 | 6.6 MEDIUM | Improper Input Sanitization in Okta Access Gateway Application Label Configuration |
| CVE-2026-78552 | 6.0 MEDIUM | Validation Bypass in Okta Access Gateway Custom Directives |
| CVE-2026-78622 | 6.0 MEDIUM | Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal |
| CVE-2026-78620 | 5.9 MEDIUM | Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling |
| CVE-2026-78631 | 5.3 MEDIUM | Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging |
| CVE-2026-78635 | 5.0 MEDIUM | Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument |
| CVE-2026-78624 | 4.9 MEDIUM | Improper Path Validation in Okta Access Gateway Backup and Restore Functionality |
| CVE-2026-78560 | 4.8 MEDIUM | Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Sour |
IV. Related Vulnerabilities
Same vendor: Okta
-
CVE-2026-78622
Improper Link Resolution in Okta Verify for Windows Uninstal -
CVE-2026-78631
Improper Restriction of Sensitive Information in Okta Hyperd -
CVE-2026-78630
Improper Input Neutralization in Okta Access Gateway SNMP Co -
CVE-2026-78635
Improper Input Validation in the Okta Privileged Access SSH -
CVE-2026-78620
Improper Path Validation in Okta Access Gateway Kerberos Con
Same weakness: CWE-303
V. Comments for CVE-2026-78629
No comments yet