Denial of Service Vulnerability in Okta RADIUS Agent
CVE-2026-78633

6.5MEDIUM

Key Information:

Vendor

Okta

Status
Okta Radius Agent
Vendor
CVE Published:
13 October 2026

What is CVE-2026-78633?

The Okta RADIUS Agent contains a vulnerability where it fails to validate the sub-attribute length during the parsing of a Vendor-Specific attribute. When a sub-attribute length of zero is encountered, this leads to an indefinite loop, exhausting worker threads and preventing new RADIUS authentication requests from being processed. This vulnerability can significantly impact the availability of authentication services, necessitating immediate attention and remediation.

Affected Version(s)

Okta RADIUS Agent 2.17.5 < 2.28.0

References

https://trust.okta.com/security-advisories/denial-of-serv...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.