CVE-2026-78629

תיאור (מקור, אנגלית)

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.

מדדים

CVSS 3.1

5.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-10/10/2026

CWE

CWE-303

מוצרים מושפעים

okta: hyperdrive

קישורים

• https://trust.okta.com/security-advisories/improper-authentication-verificatio‮… Vendor Advisory