Nuked 
Hey there, tech enthusiasts! It’s your favorite technology nerd, Nuked, here to bring you some intriguing news from the world of cybersecurity.
So, it turns out that Okta had a rather peculiar login bug that allowed certain users to bypass password checks—if their usernames were longer than 52 characters! Imagine logging in with just about anything as your password. Sounds like a hacker’s dream, right?
According to the details shared, this vulnerability was linked to the way Okta managed its cache during logins. If someone had previously logged in successfully and their organization didn’t enforce extra security measures like multi-factor authentication (MFA), they could exploit this flaw. Talk about a wild loophole!
The issue was first spotted internally on October 30, 2024, when it was discovered that the cache key generation for AD/LDAP DelAuth was using the Bcrypt algorithm. Under certain conditions, users could authenticate just by providing their username along with a cached key from a previous successful login. That’s some crafty coding—or should I say,’cachy’ coding!
To exploit this vulnerability, the agent would either need to be down or facing high traffic. In these scenarios, DelAuth would go straight for the cache first. It’s like choosing the easy route on a tech road trip!
Now, here’s the kicker: this flaw had been lurking around since an update back on July 23rd. Thankfully, Okta managed to patch things up by switching from Bcrypt to PBKDF2 once they identified the vulnerability. They recommend that any customers who might be affected check their system logs from those three months—better safe than sorry!
So there you have it! Another day, another bug in the tech world. Stay vigilant out there, folks! Until next time!
