Insecure Permissions in Okta RADIUS Agent for Windows
CVE-2026-78632

5.3MEDIUM

Key Information:

Vendor

Okta

Status
Okta Radius Agent
Vendor
CVE Published:
13 October 2026

What is CVE-2026-78632?

The Okta RADIUS Agent for Windows features a security vulnerability where the installer incorrectly assigns write permissions to sensitive directories. This misconfiguration exposes the directories containing critical configurations, AES encryption keys, and logs to any local service account on the host. As a result, malicious actors could potentially read the AES encryption key and access the encrypted Okta API token, leading to unauthorized access and data breaches.

Affected Version(s)

Okta RADIUS Agent 2.17.5 < 2.28.0

References

https://trust.okta.com/security-advisories/insecure-defau...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.