FlagThis

Okta, a prominent identity and access management provider, has been found to be vulnerable to an authorization bypass flaw. This vulnerability, which has been patched, allows attackers to gain unauthorized access to restricted resources, potentially compromising sensitive user data. The vulnerability stems from Okta’s AD/LDAP delegated authentication mechanism, which allows users to authenticate with a username longer than 52 characters. Attackers could exploit this by crafting specially designed usernames, effectively bypassing authentication checks and gaining access to resources without proper authorization. This incident highlights the importance of robust security practices, including thorough vulnerability assessments and timely patching of identified flaws.

References:

• @SecureOwl - Okta continues to have authorization bypass vulnerabilities - 20d
• @hkrn - Okta – Username Above 52 Characters Security Advisory - 20d
• trust.okta.com - Okta – Username Above 52 Characters Security Advisory - 20d
• The Verge - An Okta login bug bypassed checking passwords on some long usernames - 19d
• Vulnerability Archives - This article details Okta's announcement of a critical authentication vulnerability in its AD/LDAP Delegated Authentication system. It explains the potential impact of the flaw and urges customers to - 19d
• @feeds - A social media post outlining the Okta vulnerability and its potential for exploitation. - 19d
• The Register - Reports on the Okta authentication bypass vulnerability. - 17d
• Was ist ein Botnet - This article discusses Okta's "Secure by Design" pledge and the recent vulnerability discovered in its AD/LDAP DelAuth solution. - 16d

Classification:

• HashTags: Okta AuthorizationBypass SecurityAdvisory
• Company: Okta
• Feature: AD/LDAP delegated authenticati
• Type: Vulnerability
• Severity: Medium