Okta has issued a security advisory regarding its AD/LDAP Delegated Authentication feature. A vulnerability was discovered, allowing users with usernames over 52 characters to authenticate using a stored cache key from a previous successful login. The issue was resolved on October 30, 2024, by switching cryptographic algorithms. Affected customers are advised to investigate their system logs for any potential exploitation between July 23 and October 30, 2024.

Source: https://trust.okta.com/security-advisories/okta-ad-ldap-delegated-authentication-username/