“The Bcrypt algorithm was used to generate the cache key where we hash a combined string of userId + username + password.”
With a username of 52 characters or more and no MFA, a user could sign in off the cached key of an earlier successful login. The bug shipped in a standard release on July 23 and lived until October 30. Okta fixed it by swapping Bcrypt for PBKDF2 and told customers to turn on MFA. An identity vendor took three months to notice its login check depended on the length of a name.