Vulnerability · Published Sep 8, 2026 · Assigned by Okta
CVE-2026-78629Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
Medium 5.6
In plain English
A medium-severity security flaw in Okta Hyperdrive Agent from Okta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.1%top 96.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Okta | Okta Hyperdrive Agent | 1.2.0 – before 1.5.2 |
Weakness: CWE-303 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N