{"id":57323,"date":"2024-10-08T12:41:45","date_gmt":"2024-10-08T12:41:45","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/36444\/Okta-Classic-Customers-Told-To-Check-Logs-For-Sign-On-Bypass.html"},"modified":"2024-10-08T12:41:45","modified_gmt":"2024-10-08T12:41:45","slug":"okta-classic-customers-told-to-check-logs-for-sign-on-bypass","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/okta-classic-customers-told-to-check-logs-for-sign-on-bypass\/","title":{"rendered":"Okta Classic Customers Told To Check Logs For Sign-On Bypass"},"content":{"rendered":"
<\/div>\n
\n

Okta urged its customers to check for exploitation of a recently patched sign-on policy bypass vulnerability for Okta Classic that could have resulted in unauthorized access to applications, especially if organizations had misconfigured or weak policies in place. <\/p>\n

In an advisory to customers<\/a>, Okta said exploitation required a combination of factors: valid credentials, use of application-specific sign-on policies, and an \u201cunknown\u201d user-agent, such as Python scripts or uncommon browser types.<\/p>\n

Okta advised customers running Okta Classic to review the Okta System Log for unexpected authentications from user agents evaluated by Okta as \u201cunknown\u201d between July 17 and Oct. 4 \u2014 the day the bug was ultimately patched.<\/p>\n

While Okta<\/a> publicly reported that it services are used by 100 million users, it\u2019s not clear how many of them still use Okta Classic. The upgrade \u2014 Okta Identity Engine \u2014 was released in January 2022. When contacted Oct. 7, an Okta spokesperson referred SC Media to what was reported in the company’s most recent advisory.<\/p>\n

Here\u2019s what Okta recommended to Okta Classic customers:<\/p>\n

\n