An Okta login bug bypassed checking passwords on some long usernames

On Friday evening, Okta posted an odd update to its list of security advisories. The latest entry reveals that under specific circumstances, someone could’ve logged in by entering anything for a password, but only if the account’s username had over 52 characters.

According to the note people reported receiving, other requirements to exploit the vulnerability included Okta checking the cache from a previous successful login, and that an organization’s authentication policy didn’t add extra conditions like requiring multi-factor authentication (MFA).

Here are the details that are currently available:

On October 30, 2024, a vulnerability was internally identified in generating the cache key for AD/LDAP DelAuth. The Bcrypt algorithm was…

Related Articles

• 
  Fire Stick users uncover surprise charges that may be costing you hundreds per year – but simple trick can prevent them

  December 15, 2024
• 
  Now ChromeOS can reset itself without erasing your laptop

  December 15, 2024

Continue reading…