Okta Hyperdrive agent plugin authentication and logging vulnerabilities

Two vulnerabilities were discovered in the Okta Hyperdrive agent plugin: one returns unverified authentication responses without signed SAML assertions when MFA is not required, and another writes decoded SAML bearer assertions to local log files, exposing authentication credentials to local users.

Disclosed 8 September 2026 · Record updated 1 October 2026

Impact

Authentication bypass via unverified SAML responses and exposure of SAML credentials in local logs to unauthorized local users

Our coverage

A automated mail-sorting machine accepts envelopes without checking sender identity, while another identical machine carelessly drops sensitive letters onto the floor below.

Vulnerabilities

Two flaws disclosed in Okta's Hyperdrive agent plugin

Advisories published on 8 September 2026 describe an unverifiable authentication response and a live bearer credential written to local logs.

14 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-p4wq-g97j-pcf5
github.comhttps://github.com/advisories/GHSA-7x42-7j3m-qc6m