Notices by Edward Dore (edward@social.spheron.one)

@VModifiedMind Okta were concatenating the user ID, username and password, then feeding that string to bcrypt, the output of which was then used as the cache key.
bcrypt will only take 72 bytes as the input, so presumably the user ID and delimiters were taking up 20 bytes and thus any username longer than 52 bytes was pushing the password completely out of the cache key.

For a company who specialise in authentication, it's amazing the number of times that Okta have had major security incidents!