EUVD-2026-74175
GHSA-7xfw-pj33-px3g
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Local attacker with low privileges writes to writable HKCU registry to redirect assembly; scope change to elevated host process justifies S:C and C:H/I:H.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
4DescriptionCVE.org
The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the context of the host process or elevated installer.
AnalysisAI
Privilege escalation in Okta Hyperdrive Integration Plugin (versions 1.2.0 through pre-1.5.2) stems from the plugin resolving a .NET assembly path via the current user's HKCU registry hive and loading it with Assembly.LoadFrom without any signature or integrity check. A local attacker with standard user privileges who can write to the relevant HKCU registry key can redirect the load path to a malicious DLL, which then executes within the host process or elevated installer context - achieving privilege escalation beyond the attacker's normal trust boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the target Windows machine with at least standard user (low-privilege) credentials (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) accurately characterises this as a local privilege escalation with scope change - the high complexity (AC:H) reflects that exploitation requires specific timing or the plugin to be in an active load cycle, not merely writing to the registry. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Okta Hyperdrive Integration Plugin version 1.5.2 or later, which resolves the untrusted assembly load path by eliminating reliance on user-controllable HKCU registry values for assembly resolution and/or enforcing signature validation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running Okta Hyperdrive Integration Plugin and identify which are running versions 1.2.0 through 1.5.1; this requires local access to exploit, so prioritize systems where untrusted users have local accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-426 – Untrusted Search Path
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today