Okta Fixes Flaw in MFA App Verify Which Elevated Phishing Risk

Okta, a leader in secure identity management, has effectively addressed and resolved a recently discovered vulnerability in its Okta Verify application.

Okta Verify is a multifactor authentication (MFA) app developed by Okta, a company providing identity management solutions to large organizations worldwide. The app enhances security by requiring users to provide additional verification factors when accessing accounts, making it more difficult for unauthorized users to gain access through stolen passwords alone.

The vulnerability was first reported on April 5, 2024, by researchers Nikos Laleas and Giuseppe Trotta from Persistent Security. They identified a potential issue in the phishing resistance checks of Okta Verify's FastPass feature. Specifically, the vulnerability could allow an adversary to bypass the phishing-resistant property under certain conditions.

Okta's Security team validated these findings by April 6 and by April 8, pinpointed the issue to a logic error in the backend code, crucially outside the Okta Verify application itself.

The flaw involved a specific phishing-resistant challenge, where a user's verification or approved consent prompt was the only security measure, and the absence of an origin header mistakenly returned a “true” logic, falsely indicating a verified phishing resistance.

Okta's fix involved implementing an extra verification step to check for a valid origin header before confirming the transaction's phishing resistance, thereby closing the loophole.

The solution was tested and deployed within a development environment. After successful validation, the fix was implemented in production cells by April 10 and in staging cells by April 11. The vendor notes in the announcement that no customer action is required.

The significance of this vulnerability lies in the potential for exploitation in high-profile phishing attacks. Okta has previously faced such threats, including notable attempts to compromise its systems. For instance, in March 2021, Okta was among the targets of the Lapsus$ group, where an attempt was made to access customer data through a support engineer's account. Such incidents highlight the critical nature of maintaining robust security measures and the potential dangers of any oversight in security functionalities.

Customers of Okta and similar services are reminded of the importance of regular security assessments and the need to stay vigilant against evolving cybersecurity threats.