Okta reports authentication bypass flaw for some long usernames
Take action: You can't do much about this flaw - Okta needed to patch it, and they have. But you can learn from it - there can always be edge cases where security controls don't work - like a username longer than 52 chars in specific AD cached conditions. Always add multiple layers of controls since one control can fail.
Learn More
Okta reports they have remediated a critical vulnerability in its AD/LDAP Delegated Authentication (DelAuth) system, which could allow unauthorized access under specific conditions.
Tracked internally by Okta and identified on October 30, 2024, the flaw was introduced during a routine update on July 23, 2024. The vulnerability stemmed from the use of the Bcrypt algorithm to generate cache keys for AD/LDAP DelAuth by hashing a combination of user ID, username, and password. In cases where a username exceeded 52 characters, the flaw could potentially enable authentication without requiring the password if certain conditions were met.
The vulnerability could be exploited under the following specific circumstances:
- Username Length: Only usernames of 52 characters or longer were susceptible.
- Cache Key Dependence: The DelAuth system would allow login using a previously cached successful login attempt.
- Agent Down or High Traffic Conditions: The issue was triggered if the authentication agent was down and unreachable or if there was high traffic, which forced the DelAuth system to prioritize cached data.
The flaw allowed unauthorized access if:
- The organization’s authentication policy did not require multi-factor authentication (MFA).
- The system’s cache, from a previous successful authentication, was accessible and matched a subsequent login attempt with a 52-character username.
Okta’s response included an immediate update on October 30, 2024, replacing Bcrypt with the PBKDF2 algorithm for cache key generation to mitigate the vulnerability.
Organizations using long usernames, particularly those in Active Directory (AD) or LDAP configurations, were at increased risk if their authentication agents met the above conditions. To assist customers in identifying potential impacts, Okta has recommended that they review system logs from July 23, 2024, to October 30, 2024, for any unusual access attempts.
Okta encourages customers affected by this vulnerability to perform system log audits over the specified period to detect unauthorized logins. Additionally, for future prevention, organizations are advised to implement additional security layers, such as enforcing MFA requirements, to minimize the impact of similar vulnerabilities.
