Quick answers
- Is CVE-2026-78629 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78629 being exploited in the wild.
- How severe is CVE-2026-78629?
- Medium severity, with a CVSS score of 5.6, published 8 September 2026.
- Which products and versions are affected?
- Okta Hyperdrive agent 1.2.0 through 1.5.1.
- Is there a fix for CVE-2026-78629?
- A patch was published on 2026-09-08: Fixed in version 1.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78629 attacked?
- It is attacked with local access, in a hosted service.
- Am I affected by CVE-2026-78629?
- Check whether you run Okta Hyperdrive or Okta Hyperdrive agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper authentication verification flaw (CWE-303) in the Okta Hyperdrive agent's MFA response handling logic. When an organization's authentication policy requires no MFA for a given user, the agent returns a success response containing only a bare boolean validation indicator instead of a signed SAML assertion, removing cryptographic verification of the authentication outcome. An authenticated or locally privileged attacker can exploit this to deliver unverifiable authentication verdicts to relying applications, potentially bypassing security controls. The vulnerability affects Hyperdrive agent versions 1.2.0 through 1.5.1 and is fixed in version 1.5.2 or later. The attack vector is local with high complexity and low privilege requirements (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N).
Affected products
- Okta Hyperdrive agent 1.2.0 through 1.5.1
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in version 1.5.2