Executive brief
The Okta Hyperdrive Integration plugin for Windows contains a flaw that allows an unprivileged user with local access to load a malicious assembly without verification. By writing a specially crafted file to the registry, an attacker can execute arbitrary code within the plugin's process context or with elevated installer privileges, potentially compromising system security and sensitive corporate data.
Technical details
The vulnerability is a DLL hijacking / untrusted search path issue (CWE-426) where the Okta Hyperdrive Integration plugin resolves and loads assemblies from a registry path within the current user's registry hive (HKCU) without signature validation. The plugin uses Assembly.LoadFrom to load assemblies referenced in the user-writable registry path, bypassing standard assembly verification. An unprivileged, authenticated local user who can write to the per-user registry hive can place a malicious assembly in a location referenced by the vulnerable code path. When the plugin attempts assembly resolution and falls through to the user registry, it loads the attacker-controlled assembly, which executes with the privileges of the host process or installer. The vulnerability affects versions 1.2.0 through 1.5.1 and is fixed in version 1.5.2 or later.
Affected products
- Okta Hyperdrive Integration plugin 1.2.0 through 1.5.1
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in version 1.5.2