CVE-2026-78629: Okta Hyperdrive Authentication Bypass Flaw

CVE-2026-78629 Overview

CVE-2026-78629 is an improper authentication verification flaw [CWE-303] in the Okta Hyperdrive agent plugin. When an organization's policy specifies that no multi-factor authentication (MFA) is required for a given user, the plugin returns a success response that lacks a signed Security Assertion Markup Language (SAML) assertion. The response contains only a bare boolean validation indicator with no cryptographic artifact. Relying applications therefore accept an unverifiable authentication verdict. This weakens the integrity of the identity assertion chain and creates conditions where forged or replayed responses cannot be distinguished from legitimate ones.

Critical Impact
A local, low-privileged actor can influence authentication verdicts delivered to relying applications because the Okta Hyperdrive agent omits the signed SAML assertion, breaking cryptographic trust in the MFA response path.

Affected Products

Okta Hyperdrive agent plugin
Relying applications consuming Okta Hyperdrive MFA responses
Okta tenants configured with no-MFA policies for one or more users

Discovery Timeline

2026-09-08 - CVE-2026-78629 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78629

Vulnerability Analysis

The Okta Hyperdrive agent plugin mediates authentication decisions between the Okta identity service and downstream relying applications. When the organization's policy dictates that MFA is not required for a specific user, the plugin short-circuits the standard SAML assertion flow. Instead of returning a signed SAML assertion that the relying application can cryptographically verify, the plugin returns only a boolean success indicator.

This behavior breaks the trust model that SAML relies on. Relying applications are designed to validate a signed assertion against Okta's public key to confirm that the verdict originated from the identity provider and has not been tampered with. A bare boolean carries no such cryptographic guarantee. The vulnerability requires local access and high attack complexity, but successful exploitation impacts the integrity of authentication decisions across trust boundaries.

Root Cause

The root cause is missing authentication verification [CWE-303] in the MFA response handling logic. The plugin conflates "policy did not require MFA" with "no cryptographic proof needed," and emits a success response without generating or attaching a signed SAML assertion. The relying application receives a verdict it cannot verify, undermining the integrity property of the authentication protocol.

Attack Vector

The attack requires local access to the system running the Hyperdrive agent plugin and low privileges. An actor positioned to intercept, modify, or inject responses along the local plugin-to-application path can manipulate the boolean indicator without triggering signature validation failures, because no signature is present. The scope is changed, meaning the impact crosses the security authority of the vulnerable component into the relying application. Confidentiality and availability are unaffected; integrity of the authentication verdict is the primary loss.

See the Okta Security Advisory CVE-2026-78629 for vendor-authoritative technical details.

Detection Methods for CVE-2026-78629

Indicators of Compromise

Okta Hyperdrive agent responses to relying applications that lack a <saml:Assertion> element or Signature block for users covered by no-MFA policies.
Authentication success events for users whose policy assignment recently changed to a no-MFA path without corresponding SAML assertion artifacts in application logs.
Unexpected local process interactions with the Hyperdrive agent plugin binary or its inter-process communication channel.

Detection Strategies

Compare Okta Hyperdrive agent response payloads against expected SAML assertion structure and flag any success verdict missing a signed assertion.
Correlate Okta system log MFA events with relying application session establishment events to identify sessions created without a verifiable assertion.
Audit Okta policy configurations to enumerate users assigned to no-MFA policies and prioritize monitoring of relying applications those users access.

Monitoring Recommendations

Enable verbose logging on the Hyperdrive agent and forward events to a centralized analytics platform for retention and correlation.
Monitor for local privilege escalation attempts or unauthorized process access on hosts running the Hyperdrive agent.
Track changes to Okta authentication policies, particularly transitions that remove MFA requirements from users or groups.

How to Mitigate CVE-2026-78629

Immediate Actions Required

Review the Okta Security Advisory and apply any vendor-supplied update for the Hyperdrive agent plugin.
Audit Okta authentication policies and remove no-MFA exemptions where they are not strictly required.
Restrict local access to systems hosting the Hyperdrive agent plugin to trusted administrators only.

Patch Information

Refer to the Okta Trust portal advisory for CVE-2026-78629 for fixed versions and remediation guidance. Okta publishes updated Hyperdrive agent builds through its standard distribution channels. Apply the vendor-recommended version as soon as it is available in your environment.

Workarounds

Require MFA for all users where operationally feasible so the vulnerable no-MFA code path is not exercised.
Configure relying applications to reject any authentication response that does not include a signed SAML assertion, when this option is exposed by the application.
Segment hosts running the Hyperdrive agent from general-purpose user workloads to limit local access exposure.

bash

# Example: enumerate Okta users assigned to no-MFA policies for review
# (Run against the Okta Management API with an appropriately scoped token)
curl -s -H "Authorization: SSWS $OKTA_API_TOKEN" \
  "https://$OKTA_DOMAIN/api/v1/policies?type=MFA_ENROLL" \
  | jq '.[] | select(.status=="ACTIVE") | {id, name, priority}'