CVE-2026-78633

CVE-2026-78633 · Denial of Service in Okta RADIUS Agent Packet Parser

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.

CVSS 6.5 · Medium · EPSS 0.2% · Fix available

Published

2026-10-13T20:08:40.528Z

Updated

2026-10-16T15:31:55.280Z

Check your server →