CVE-2026-78633
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Risk Assessment
An attacker could send crafted RADIUS requests, causing authentication service unavailability and blocking user logins.
Recommendation
Update the Okta RADIUS Agent to a version with sub-attribute length validation and monitor for unusual RADIUS requests.
Other vulnerabilities in Okta RADIUS Agent
Original NVD description (English source)
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS