Okta just squashed a particularly unusual bug in its software.
The digital security management company posted a bug fix report to its website (as spotted by The Verge) letting users know that a glitch in the system that theoretically allowed bad actors to gain access to accounts had been ironed out. Sounds normal enough, right? Well, here’s the kicker: The bug could’ve allowed someone to log into an account without entering the password as long as the username was 52 characters or longer.
Mashable Light Speed
Largest US healthcare data breach exposes medical records of 100 million customers
“During specific conditions, this could allow users to authenticate by only providing the username with the stored cache key of a previous successful authentication,” Okta wrote.
It should be re-emphasized that this is no longer a concern for Okta users. The bug has been fixed. Unfortunately, it existed in the system for about three months, as Okta’s report said the software had been affected since July until someone noticed on Oct. 30. That’s a very long time for such a vulnerability to be present, but it’s unclear at this point if anyone was negatively affected by it.
