Okta login vulnerability skipped password checks
Okta, one of the world's leading providers of single sign on service and identity management, revealed at the end of October that the company had fixed a bug in its service that caused a potentially serious security threat. Essentially, the bug skipped password checking for any account with a username longer than 52 characters. Bad actors could potentially get into these accounts just by entering the correct username, even if the password they provided was wrong or even absent. This, of course, assumes that a password is the only protection on the account in question.
The bug was introduced in an update that rolled out near the end of July 2024, and was noticed and fixed about three months later. The bug was not widely reported, and took a while to notice and nail down. The vast majority of usernames for any login portal tend to be under 52 characters, though some, such as those that include somebody's first and last name as well as their company email domain, may bust that limit. The vulnerability relied on multi-factor authentication not being enabled, and on the luck of the draw; logins in this case got authenticated by a cache of the encrypted key from a previous successful login. This meant that if the login attempt hit the main Okta authentication server before the cache could be loaded, it had the chance to be caught and stopped.
The relatively narrow set of circumstances that would allow this exploit to be used meant that its potential to cause chaos was not great, but the fact that this happened to a firm like Okta is telling. Security risks abound in many forms in today's digital world, and as such, the company warned all users, affected or not, to set up multi-factor authentication alongside any existing protections they had in place. Many login services require users to set up some kind of secondary authorization as a condition of creating and verifying their new account, making a potentially disastrous exploit like this one little more than a cautionary tale for the average user.
