CVE-2026-78633

Executive Summary

CVE-2026-78633 is a denial-of-service vulnerability in the Okta RADIUS Agent in which the parser does not validate the length field of a sub-attribute inside a Vendor-Specific attribute (VSA, type 26). A sub-attribute declared with a length of zero causes the parsing routine to loop indefinitely, exhausting worker threads and preventing the agent from servicing new RADIUS authentication requests. Organizations that use the Okta RADIUS Agent to broker MFA or authentication for VPN concentrators, firewalls, and network access devices are affected; any party with adjacent network access to the RADIUS listener (UDP/TCP 1812) can trigger the condition without authentication.

Technical Analysis

RADIUS attribute 26 (Vendor-Specific) carries one or more encapsulated sub-attributes, each of which begins with a type octet, a length octet, and up to 253 octets of value. The length octet is normally constrained to the range 2–255 (the length includes the type and length fields themselves, so a value of 0 or 1 is structurally invalid). The Okta RADIUS Agent, according to the NVD description, does not validate this sub-attribute length while parsing the Vendor-Specific attribute. When a sub-attribute reports a length of zero, the parser fails to advance its read cursor and re-enters the same parse step on the same input offset — an unbounded loop.

Because RADIUS request handling is performed by a bounded pool of worker threads, each malformed packet consumes one worker permanently for as long as the loop runs. There is no abort condition, iteration cap, or timeout described in the advisory, so the thread does not self-recover. Once every worker is occupied, the server socket may still accept datagrams at the kernel level (the receive buffer fills or packets are silently dropped) but no new authentication request can be processed; legitimate authentication traffic fails or times out.

The root cause maps to CWE-835 (Loop with Unreachable Exit Condition, i.e., "Infinite Loop"). The relevant CORRECTIVE pattern is strict structural validation of the VSA sub-attribute TLV chain: reject any sub-attribute whose length is less than the minimum header size (2) or greater than the remaining declared VSA payload length, and always advance the offset by at least the header size so the loop is guaranteed to make progress.

Attack surface and preconditions:

• Network vector, adjacent access (AV:A). The attacker must be able to reach the RADIUS service port — 1812/udp for authentication, 1645/udp on legacy deployments — from the same network segment or through any path that reaches the listener (including a compromised internal host or guest network with reachability to the RADIUS server).
• No authentication, no user interaction, and no privileges are required (PR:N, UI:N) to reach the parsing code, since the malformed attribute is processed before credential validation completes.
• Complexity is low (AC:L): the malformed structure is deterministic and consists of a single crafted attribute; no race condition or timing precision is required.
• Scope is unchanged (S:U): the impact is confined to the Okta RADIUS Agent process and does not cross a trust boundary into other components under the vulnerable component's security authority.

Parse-path considerations for defenders: the vulnerable surface is the attribute-decoding routine that walks VSA (type 26) sub-attributes, not the outer RADIUS attribute loop. Malformed input may therefore appear valid at the outer TLV layer (correct outer attribute 26 length) while being malformed only at the inner sub-attribute length. Note: the NVD description does not identify specific function, class, or file names for this parser, and none are asserted here.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-78633. The attack chain below is inferred from the vulnerability class (CWE-835 in a RADIUS VSA parser) as described in the NVD description. It does not rely on any implementation detail not present in that description.

1. Reconnaissance / target identification. The attacker identifies a host running the Okta RADIUS Agent by probing UDP/1812 (and legacy UDP/1645) for reachability, or by scanning internal ranges for the RADIUS service. Because RADIUS over UDP does not complete a TCP handshake, the attacker typically characterizes the service by sending a standard Access-Request and observing whether an Access-Challenge, Access-Accept, Access-Reject, or no response is returned. A valid RADIUS response confirms the service and, because the Okta RADIUS Agent is the target, likely confirms the software. No credentials are needed to elicit a response, since the parser processes the packet prior to credential validation.

2. Triggering the flaw. The attacker crafts a single Access-Request containing an attribute of type 26 (Vendor-Specific). Inside that VSA, the attacker places a sub-attribute whose length octet is set to 0. The outer attribute and packet are otherwise well-formed and of legal size. When the agent parses the VSA, it reads the sub-attribute, does not validate the length, and the parse cursor fails to advance — the loop iterates on the same offset indefinitely.

3. Payload / execution. At the vulnerability-class level: the payload is a single malformed RADIUS Access-Request permitting an unauthenticated sender to drive an unbounded loop in the server's VSA parsing routine. Submission requires only a UDP datagram (or TCP stream, if the deployment uses RADIUS/TCP) from any host able to reach the listener. No code execution, no shell, and no privilege escalation are involved; the "execution" effect is the consumption of one worker thread per malformed packet.

4. Post-exploitation impact. With a small number of malformed packets — one per available worker thread — the attacker permanently occupies the agent's worker pool. Subsequent legitimate Access-Requests are not serviced. Because the condition persists for as long as the loop runs, the disruption is sustained rather than a transient burst: affected clients (VPN, 802.1X, firewall MFA, PAM, etc.) fail to authenticate. Restoring service requires restarting the Okta RADIUS Agent process. The attacker can suppress recovery by continuing to send crafted packets as the service comes back.

Note: the NVD description does not specify whether a single packet suffices to exhaust all workers or how the worker pool is sized; defenders should treat worker count as deployment-dependent and verify via testing in a lab before relying on any threshold.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium), with subscores AV:A / AC:L / PR:N / UI:N / S:U / C:N / I:N / A:H. The vector composes as follows:

• Confidentiality (C:N) and Integrity (I:N): no data is read or modified; the flaw is a pure availability condition.
• Availability (A:H): total loss of the authentication service is possible — no new RADIUS authentication requests can be served once workers are exhausted.
• Attack Vector (AV:A): the attacker must be on the same or an adjacent network segment able to reach the RADIUS listener; this is common for a RADIUS server, since it serves internal VPN and network-access infrastructure.
• Privileges (PR:N) and User Interaction (UI:N): no account or user action is required.
• Scope (S:U): the compromise does not extend beyond the Okta RADIUS Agent process.

Business impact: the Okta RADIUS Agent is typically the integration point between Okta and enterprise network devices — VPN gateways, firewalls, switches implementing 802.1X, and other PAM/network access products. Denying the agent denies MFA/authentication for every dependent system. Consequences include remote-work outages (VPN), inability to authenticate to network infrastructure, and, in some environments, lockout of administrative access paths that themselves depend on RADIUS. Because the attack is unauthenticated and network-adjacent, exposure expands wherever the RADIUS port is reachable beyond strictly controlled segments — including flat internal networks, guest networks that can route internally, and any internet-facing or DMZ RADIUS deployment.

EPSS is 0.00208 (10.1st percentile), indicating very low current probability of exploitation activity; CISA KEV does not list this CVE, and there is no public PoC or exploit code. Blast radius is nonetheless potentially large in affected deployments because the impact is a hard authentication outage of a chokepoint service.

Detection Guidance

Sigma Rule

title: Potential Okta RADIUS Agent VSA Length-Zero DoS Attempt (CVE-2026-78633)
id: 9c1f4a8e-2b77-4c3a-8f0e-7d5a1b2c3d4e
status: experimental
description: Detects repeated malformed RADIUS Vendor-Specific attribute sub-attributes (length 0) targeting the Okta RADIUS Agent, causing worker-thread exhaustion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78633
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
  - cve.2026.78633
logsource:
  category: network_connection
  product: radius
detection:
  selection_port:
    dst_port:
      - 1812
      - 1645
  selection_keywords:
    - 'vendor specific'
    - 'vsa length 0'
    - 'invalid sub-attribute'
  filter_known_good:
    src_ip:
      - '10.0.0.0/8'
    status: allowed
  condition: selection_port and selection_keywords and not filter_known_good
falsepositives:
  - Malformed RADIUS clients with non-compliant VSA implementations
level: medium

YARA Rule

rule Okta_RADIUS_Agent_VSA_LengthZero_DoS
{
    meta:
        author = "valtersit.com"
        description = "Detects RADIUS packets containing a Vendor-Specific attribute (type 26) with a zero-length sub-attribute"
        reference = "CVE-2026-78633"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $vsa = { 1A ?? ?? }          // RADIUS attribute type 26 (Vendor-Specific)
        $zero_len_subattr = { 1A ?? ?? [0-30] 00 }  // followed by a sub-attribute with length byte 0x00

    condition:
        any of them and filesize < 4096
}

Suricata IDS Rule

alert udp any any -> any 1812 (msg:"CVE-2026-78633 Okta RADIUS Agent VSA Length-Zero Denial of Service Attempt"; flow:stateless; content:"|1a|"; offset:0; depth:1; byte_test:1,=,0,1,relative; threshold: type both, track by_src, count 5, seconds 10; reference:cve,2026-78633; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-78633; classtype:attempted-dos; sid:2026786331; rev:1;)

Elastic Detection

network where
  destination.port in (1812, 1645) and
  event.action == "network_flow" and
  (network.transport == "udp" or network.transport == "tcp") and
  (process.name == "radius" or process.name == "okta-radius-agent") and
  network.bytes > 0 and
  event.outcome == "failure"
  // correlate with a high volume of malformed RADIUS requests from the same source

Splunk SPL Query

index=network sourcetype=radius OR sourcetype=firewall
| search dest_port IN (1812, 1645)
| stats count dc(src_ip) AS src_count values(dest_ip) AS targets BY src_ip
| where count > 50 AND src_count < 3
| table _time src_ip targets count
| sort - count

Wazuh OSSEC Rule

<group name="okta_radius,cve-2026-78633,">
  <rule id="202678633" level="10">
    <decoded_as>radius</decoded_as>
    <field name="dest_port">^(1812|1645)$</field>
    <match>vendor-specific sub-attribute length is zero|invalid vsa sub-attribute|RADIUS parse error</match>
    <description>CVE-2026-78633: Possible malformed RADIUS VSA sub-attribute causing Okta RADIUS Agent worker exhaustion</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict reachability of the RADIUS listener. Ensure UDP/TCP 1812 (and legacy 1645) is not reachable from guest networks, general user VLANs, or the internet. Enforce allow-listing of known RADIUS clients on the network path (ACLs, firewall policies, or the platform's client allow-list) so only trusted network devices can send packets to the agent.
• Deploy compensating network controls. If reachable, front the RADIUS service with a WAF/IPS or a UDP-aware inspection device that can drop malformed VSA traffic, and enable the Suricata rule above.
• Monitor and auto-restart with caution. If the agent supports it, enable process supervision and health checks so a worker-exhaustion condition is detected and the process is restarted. Note this is a stop-gap: it does not prevent recurrence and may not trigger while workers are busy but not terminated. Treat restarts as break-glass, not remediation.
• Prefer a hardened RADIUS front door. Where architecture allows, route authentication via an identity proxy or proxy RADIUS that validates and norms incoming attributes before they reach the Okta RADIUS Agent.

2. Patch / upgrade steps:

• No fixed version is available as of this report. No vendor advisory or patch reference has been published; affected version ranges are unknown.
• Monitor Okta's security advisory and release-note channels for an update addressing CVE-2026-78633, then upgrade the Okta RADIUS Agent to the first release that includes the fix. Because no patch currently exists, do not expect a version-based remediation path today.
• Track NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-78633) for CVSS changes, references, and vendor-advisory links.

3. Long-term hardening:

• Enforce input validation on any RADIUS attribute processor: reject VSA sub-attributes whose length is less than the minimum legal value or that exceeds the containing attribute's remaining length, and guarantee loop progress by always advancing the parse offset by at least the fixed header size.
• Adopt fuzz testing for the RADIUS protocol parser, with malformed VSA sub-attribute length fields (0, 1, 255, and overlong values) in the corpus.
• Segment and least-privilege authentication infrastructure: place RADIUS servers in a dedicated management segment with strict east-west controls, and require RADIUS clients to be explicitly enumerated.
• Apply defense in depth: capacity/rate limiting at the network edge for RADIUS traffic, watchdog process supervision, and alerting on worker/thread saturation so an outage is noticed and attributed quickly.

References

• NVD — CVE-2026-78633: https://nvd.nist.gov/vuln/detail/CVE-2026-78633
• CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop'): https://cwe.mitre.org/data/definitions/835.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Okta Security Advisories and Trust site (vendor advisory not yet published for this CVE): https://trust.okta.com/
• CISA KEV Catalog (status: not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-78633 at the time of writing; EPSS is 0.00208 (10.1st percentile), no public PoC or exploit code exists, and there is no CISA KEV listing.