Executive brief
The Okta Hyperdrive agent plugin fails to include a cryptographically signed SAML assertion in authentication responses when an organization's policy allows MFA-free access for certain users. Instead of a verifiable authentication proof, the relying application receives only an unsigned boolean indicator, allowing attackers with local or privileged access to forge successful authentication verdicts and gain unauthorized access to protected systems.
Technical details
The vulnerability is an improper authentication verification flaw (CWE-303) in the Okta Hyperdrive agent's MFA response handling logic. When an organization's authentication policy requires no MFA for a given user, the agent returns a success response containing only a bare boolean validation indicator instead of a signed SAML assertion, removing cryptographic verification of the authentication outcome. An authenticated or locally privileged attacker can exploit this to deliver unverifiable authentication verdicts to relying applications, potentially bypassing security controls. The vulnerability affects Hyperdrive agent versions 1.2.0 through 1.5.1 and is fixed in version 1.5.2 or later. The attack vector is local with high complexity and low privilege requirements (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N).
Affected products
- Okta Hyperdrive agent 1.2.0 through 1.5.1
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in version 1.5.2