FlagThis

Okta, a prominent identity and access management provider, has been found to be vulnerable to an authorization bypass flaw. This vulnerability, which has been patched, allows attackers to gain unauthorized access to restricted resources, potentially compromising sensitive user data. The vulnerability stems from Okta’s AD/LDAP delegated authentication mechanism, which allows users to authenticate with a username longer than 52 characters. Attackers could exploit this by crafting specially designed usernames, effectively bypassing authentication checks and gaining access to resources without proper authorization. This incident highlights the importance of robust security practices, including thorough vulnerability assessments and timely patching of identified flaws.

References:

• @SecureOwl - Okta continues to have authorization bypass vulnerabilities - 4d
• @hkrn - Okta – Username Above 52 Characters Security Advisory - 4d
• trust.okta.com - Okta's official security advisory disclosing the username vulnerability. - 4d
• The Verge - An Okta login bug bypassed checking passwords on some long usernames - 4d
• Vulnerability Archives - This article details Okta's announcement of a critical authentication vulnerability in its AD/LDAP Delegated Authentication system. It explains the potential impact of the flaw and urges customers to - 4d
• Engadget is a web magazine with obsessive daily coverage of everything new in gadgets and consumer e - Engadget article on the Okta Vulnerability that allowed passwordless logins for accounts with long usernames. - 4d
• The Verge - The Verge's reporting on the Okta vulnerability and its potential impact. - 4d
• @feeds - A social media post outlining the Okta vulnerability and its potential for exploitation. - 3d
• The Register - Reports on the Okta authentication bypass vulnerability. - 2d
• Wie Hacker ML fu - This article discusses Okta's "Secure by Design" pledge and the recent vulnerability discovered in its AD/LDAP DelAuth solution. - 1d

Classification:

• HashTags: Okta AuthorizationBypass SecurityAdvisory
• Company: Okta
• Feature: AD/LDAP delegated authenticati
• Type: Vulnerability
• Severity: Medium