Connect with us

Hi, what are you looking for?

Webinar News NetworkWebinar News Network

Tech News

An Okta login bug bypassed checking passwords on some long usernames

Illustration of a password above an open combination lock, implying a data breach.
Illustration by Cath Virginia / The Verge | Photo from Getty Images

On Friday evening, Okta posted an odd update to its list of security advisories. The latest entry reveals that under specific circumstances, someone could’ve logged in by entering anything for a password, but only if the account’s username had over 52 characters.

According to the note people reported receiving, other requirements to exploit the vulnerability included Okta checking the cache from a previous successful login, and that an organization’s authentication policy didn’t add extra conditions like requiring multi-factor authentication (MFA).

Here are the details that are currently available:

On October 30, 2024, a vulnerability was internally identified in generating the cache key for AD/LDAP DelAuth. The Bcrypt algorithm was…

Continue reading…

You May Also Like

Politics

With the 2024 U.S. election around the corner, celebrities have been stepping forward to publicly endorse either Vice President Kamala Harris or former President...

Editor's Pick

Jeffrey Miron The standard argument for scope-of-practice (SOP) laws—and more generally, for occupational licensing—is that such regulation improves the quality of services by keeping...

Editor's Pick

Alex Nowrasteh Steven Malanga, a senior fellow at the Manhattan Institute and a senior editor of City Journal, argues that there is a crime...

Tech News

Illustration by Haein Jeong / The Verge Thousands of creatives, including famous actors like Kevin Bacon and Kate McKinnon, along with other actors, authors,...