EUVD-2026-74181
GHSA-p4wq-g97j-pcf5
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Local agent interaction required (AV:L), no-MFA policy condition must apply (AC:H), low-privilege account needed (PR:L); integrity-only impact crosses to relying app (S:C/I:H).
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
4DescriptionCVE.org
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.
AnalysisAI
The Okta Hyperdrive Agent plugin improperly implements SAML authentication verification - when an organization's policy exempts a given user from MFA, the agent returns a success response containing only a bare boolean flag rather than a cryptographically signed SAML assertion. The relying application receives an authentication verdict it cannot verify, creating an exploitable integrity gap in the SSO trust chain. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions to align: (1) the attacker must hold a valid low-privilege Okta account (PR:L); (2) the targeted user's account must fall under an organizational policy that exempts them from MFA - accounts subject to MFA requirements are not affected; (3) the attacker must be operating in a context where they can interact with the local Hyperdrive Agent process (AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.6 (Medium) reflects a balanced picture: AV:L constrains exploitation to environments where an attacker can interact with the local agent process; AC:H requires a specific policy condition (the target user must be in a no-MFA-required group); and PR:L requires the attacker to already hold a valid low-privilege account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Okta Hyperdrive Agent to version 1.5.2 or later, which is confirmed as the patched release per the vendor advisory at https://trust.okta.com/security-advisories/improper-authentication-verification-in-the-okta-hyperdrive-agent-mfa-response-handling-cve-2026-78629. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today