CVE-2026-78574: Untrusted Search Path in Okta Okta Hyperdrive Integration Plugin

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path located in the current user's registry hive. The assembly is loaded using Assembly.LoadFrom without performing signature validation or integrity checks. This untrusted search path vulnerability enables an attacker to place a malicious assembly at the referenced path, which will be loaded and executed within the context of the host process or an elevated installer, potentially leading to code execution with elevated privileges.

Successful exploitation can result in execution of malicious code within the context of the host process or elevated installer, leading to complete compromise of confidentiality and integrity of the affected system. Availability impact is not indicated. The CVSS score of 7.5 reflects high severity with local attack vector, high privileges required, no user interaction, and scope changed due to potential privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with the plugin and restrict access to the current user's registry hive to trusted users only. Avoid running the plugin with elevated privileges if possible.