Okta’s login bug bypassed checking passwords for some long usernames

On Friday evening, Okta posted a strange update to its security advisory list. The latest entry reveals that under certain circumstances, someone could log in by entering anything for a password, but only if the account’s username is longer than 52 characters.

According to the note people reported receiving, other requirements for exploiting the vulnerability include Okta checking the cache from previous successful logins, and that the organization’s authentication policy did not add additional conditions such as requiring multi-factor authentication (MFA).

Here is the information currently available:

On October 30, 2024, a vulnerability was identified in AD/LDAP DelAuth cache key generation. The Bcrypt algorithm was…

Continue reading…