CVE-2026-78633 in RADIUS Agent
Summary
by MITRE • 10/14/2026
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in the Okta RADIUS Agent stems from an insufficient input validation mechanism within the protocol parsing logic, specifically concerning Vendor-Specific attributes (VSAs). In the Remote Authentication Dial-In User Service (RADIUS) protocol framework defined by RFC 2865 and extended by various vendor-specific implementations, VSAs allow network equipment vendors to include proprietary information in authentication packets. These attributes consist of a type field, a length field, a vendor-identifier, and one or more sub-attributes. Each sub-attribute also contains its own type and length fields that dictate how many bytes the parser should consume for data processing. The critical flaw lies in the agent's failure to verify that the declared length of these sub-attributes is greater than zero before initiating the parsing routine.
When a malicious actor crafts a RADIUS packet containing a Vendor-Specific attribute with a sub-attribute length field set to zero, the parser enters an infinite loop condition. Because the code attempts to process data based on the specified length without checking for this edge case, it fails to advance the pointer or break out of the processing cycle. This behavior effectively traps the worker thread responsible for handling that specific authentication request in a non-terminating state. The thread remains occupied indefinitely, unable to return to the pool of available resources to handle subsequent requests from legitimate users or network devices attempting to authenticate through the RADIUS infrastructure.
The operational impact of this flaw is severe, manifesting as a denial-of-service condition against the Okta RADIUS Agent service. As multiple such malformed packets are processed, either by a single persistent source or distributed across many attackers, the finite pool of worker threads becomes exhausted. Once all available threads are trapped in infinite loops, the agent loses its capacity to accept and process new authentication requests. This results in a complete outage for any identity-dependent services relying on this RADIUS endpoint, effectively blocking access for legitimate users and potentially disrupting critical network infrastructure that depends on centralized authentication via Okta.
From a classification perspective, this vulnerability aligns with CWE-835, which describes the use of a loop construct where an exit condition is never met, leading to infinite looping or resource exhaustion. It also relates closely to CWE-20, Improper Input Validation, as the root cause is the failure to sanitize and validate incoming data structures against expected constraints before processing. In terms of offensive security frameworks, this technique corresponds to MITRE ATT&CK T1498, Network Denial of Service, specifically under sub-techniques involving resource exhaustion through protocol abuse or malformed packet injection.
Mitigation strategies must focus on both immediate remediation and long-term architectural resilience. The primary solution is for the vendor to apply a software patch that enforces strict length validation checks within the VSA parsing logic, ensuring that any sub-attribute with a zero-length field triggers an error response rather than entering a processing loop. Administrators should ensure their Okta RADIUS Agent instances are updated to the latest secure version as soon as it becomes available. In environments where patching is not immediately feasible, network-level mitigations such as rate limiting on incoming RADIUS traffic or deploying intrusion prevention systems capable of detecting and dropping malformed packets with anomalous attribute structures can help mitigate the risk of thread exhaustion by filtering out malicious inputs before they reach the vulnerable application layer.