Denial of Service in Okta RADIUS Agent Packet Parser CVE-2026-78633 - Oct 13, 2026

Description

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.

Preconditions

A client device with network access to the agent's RADIUS UDP port sends one or more Access-Request packets containing a Vendor-Specific attribute with a zero-length sub-attribute.

Affected product and versions

Customers using the Okta RADIUS Agent on Windows versions 2.17.5 to 2.27.0 are affected.

Customer Recommendations

To remediate this vulnerability, upgrade the Okta RADIUS Agent to version 2.28.0 or greater.

Resolution

The vulnerability is present in Okta RADIUS Agent versions 2.17.5 to 2.27.0, and is resolved in version 2.28.0.

CVE details

CVE ID	CVE-2026-78633
Published Date	2026-10-13
Vulnerability Type	Denial of Service (Infinite Loop)
CWE	CWE-835 – Loop with Unreachable Exit Condition ('Infinite Loop')
CVSS v3	Score: 6.5 Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H