Okta vulnerability allowed accounts with long usernames to log in without a password

"Okta has revealed a vulnerability that allowed accounts with 52 or more characters in the username to bypass password authentication when conditions were met, risking unauthorized access."

"The vulnerability stemmed from a standard update on July 23, 2024, and went unnoticed until discovered and fixed on October 30."

"Organizations were advised to check their access logs if their accounts met the conditions, as the vulnerability could allow easy-to-guess usernames to breach accounts."

"Okta pledged to improve communication with customers after a prior incident involving the Lapsus$ threat group, indicating a commitment to address security issues proactively."

Read at Engadget