Okta Fixes Critical Vulnerability Allowing Sign-On Policy Bypass

Okta patched a vulnerability in its Okta Classic product that could have allowed attackers to bypass application-specific sign-on policies (including device-type restrictions, network zones, and some authentication requirements) if they had valid credentials and used an "unknown" user-agent; the issue stemmed from a July 17, 2024 update, was identified on September 27, 2024, and fixed on October 4, 2024, and Okta advised customers to review logs for unexpected successful authentications and other indicators.