Conversation

I'm a tad bit annoyed by #infosec professionals referring to the #Okta bug that was just announced as an "authentication" bypass or vulnerability when it is, rather, an *authorization* issue.
Authz bypasses are bad, but dramatically less bad than authn bypasses, because the size of the population able to take advantage of them is much smaller and typically more trusted.
Getting the terminology right matters.
Ref: https://trust.okta.com/security-advisories/okta-classic-application-sign-on-policy-bypass-2024/