Richard Lawler / The Verge:
After July 23, 2024, Okta fixed a flaw that allowed users to log in with any password if their account username was longer than 52 characters under certain conditions.— Although the vulnerability has now been resolved, Okta said that for three months it had been used to gain access to accounts with usernames of at least 52 characters.
