CVE-2026-78629: Incorrect Implementation of Authentication Algorithm in Okta Okta Hyperdrive Agent

The Okta Hyperdrive agent plugin returns a success response lacking a signed SAML assertion when no MFA is required by policy for a user. This response includes only a bare boolean validation indicator without any cryptographic artifact, causing the relying application to receive an unverifiable authentication verdict. This flaw affects versions >=1.2.0 and <1.5.2, including version 1.2.0 exactly. The CVSS 3.1 base score is 5.6 (medium severity), reflecting a local attack vector with high attack complexity and low privileges required, no user interaction, and impact limited to integrity.

The vulnerability allows an attacker with local access and low privileges to cause the Okta Hyperdrive agent to return an authentication success response that cannot be cryptographically verified by the relying application. This undermines the integrity of the authentication process, potentially allowing unauthorized access or bypass of intended authentication controls when MFA is not required by policy. Confidentiality and availability are not impacted.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, relying applications should consider additional verification mechanisms or policy adjustments to mitigate the risk of unverifiable authentication responses.