An email from Okta regarding a resolved security vulnerability in Okta AD/LDAP DelAuth. It states that accounts with usernames of 52 characters or more, without MFA policies, could allow authentication using only the username.

Notices where this attachment appears

1. Embed this notice
   V is for... (vmodifiedmind@know.me.uk)'s status on Saturday, 09-Nov-2024 05:34:44 JST V is for...

   Sure there’s a great reason why the code was written such that regardless of length of username you may allow some length can magically skip the password phase.

   And these are the companies people sit in the middle doing SSO and MFA with. Or in other words. They’re a bloody vulnerability you’re adding to your stack you thought were helping you with identity and security management.