Okta Hyperdrive Agent CVEs and Security Vulnerabilities

CVE-2026-78629

Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Okta

Products

Hyperdrive Okta Hyperdrive Agent

CVE-2026-78631

Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging

The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed