OKTA AD/LDAP DELEGATED AUTHENTICATION VULNERABILITY

Summary from the TLDR InfoSec newsletter

Okta discovered a vulnerability in the DelAuth procedure for Okta AD/LDAP that allows users with usernames with a length equal to or greater than 52 characters to authenticate with only a username and a stored cache key of a previous authentication (no password needed). This issue was resolved in Okta's production systems on October 30. Okta recommends that customers review their logs from July 23 to October 30 for evidence of exploitation.