On Friday night, Okta posted an odd replace to its listing of safety advisories. The newest entry reveals that underneath particular circumstances, somebody may’ve logged in by getting into something for a password, however provided that the account’s username had over 52 characters.
In line with the word individuals reported receiving, different necessities to use the vulnerability included Okta checking the cache from a earlier profitable login, and that a corporation’s authentication coverage didn’t add additional situations like requiring multi-factor authentication (MFA).
Listed here are the small print which might be at the moment accessible:
On October 30, 2024, a vulnerability was internally recognized in producing the cache key for AD/LDAP DelAuth. The Bcrypt algorithm was…
Proceed studying…
/cdn.vox-cdn.com/uploads/chorus_asset/file/25537887/STK275_CROWDSTRIKE_CVIRGINIA_D.jpg "CrowdStrike says it’s not to blame for Delta’s days-long outage")
/cdn.vox-cdn.com/uploads/chorus_asset/file/25299201/STK453_PRIVACY_B_CVirginia.jpg "An Okta login bug bypassed checking passwords on some long usernames")
/cdn.vox-cdn.com/uploads/chorus_asset/file/25299201/STK453_PRIVACY_B_CVirginia.jpg&description=An%20Okta%20login%20bug%20bypassed%20checking%20passwords%20on%20some%20long%20usernames){kind=link}