On Friday night, Okta posted an odd replace to its record of safety advisories. The most recent entry reveals that underneath particular circumstances, somebody may’ve logged in by coming into something for a password, however provided that the account’s username had over 52 characters.
Based on the observe folks reported receiving, different necessities to take advantage of the vulnerability included Okta checking the cache from a earlier profitable login, and that a corporation’s authentication coverage didn’t add additional situations like requiring multi-factor authentication (MFA).
Listed below are the small print which might be at present out there:
On October 30, 2024, a vulnerability was internally recognized in producing the cache key for AD/LDAP DelAuth. The Bcrypt algorithm was…
