CVE-2024-3596Blast-RADIUS, MD5 collision forges Access-Accept
What broke
RADIUS (RFC 2865) authenticates responses with an MD5-based Response Authenticator. A chosen-prefix collision lets an on-path attacker turn Access-Reject into Access-Accept. CHAP and PAP without Message-Authenticator are the easy cases. MFA that sits behind that RADIUS exchange is bypassed, because the NAS never sees the reject. CVSS 9.0. The research name is Blast-RADIUS. Vendor patching continued into 2026 (Schneider, among others, in April 2026).
Why it matters
RADIUS is still how VPN, Wi-Fi, and a surprising amount of MFA talk to the IdP. A protocol-level forge is an MFA bypass that does not care which vendor sold you the token. This is why we keep a 2024 CVE in a 2025-2026 catalog: the control (Message-Authenticator or RadSec) is what is still missing.
What to do
- Require
Message-Authenticatoron every RADIUS client and server. Reject packets that omit it. - Move to RadSec (RADIUS over TLS) where the NAS supports it.
- Stop sending PAP/CHAP across a network you do not trust. Prefer EAP methods that bind to TLS.
- Inventory MFA products that still front RADIUS. A "phishing-resistant" factor behind a forgeable Access-Accept is not phishing-resistant.
After you patch
RADIUS carries authentication for network and VPN access, and its legacy cryptography is the recurring weakness rather than any single implementation.
- Rotate every shared secret, using long random values that differ per client rather than a single reused string.
- Move RADIUS traffic inside an authenticated transport, RADIUS over TLS or IPsec, so the protocol's own integrity weaknesses stop being reachable.
- Prefer EAP methods with mutual authentication over PAP or CHAP wherever the client supports it.
- Audit which devices still authenticate over RADIUS and what they grant, since network gear and VPN concentrators are common initial-access targets. See MFA.
Sources
- NVD: CVE-2024-3596
- Blast-RADIUS research (2024) and follow-on vendor advisories through 2026
Related identity CVEs
Related on Start with Identity
- BlogFake ChatGPT, Gemini and Claude ad portals capture credentials and MFA codes with operator-driven phishing
Island found a human-operated phishing platform posing as AI advertising tools. A browser-in-the-browser Connect window steals Google and Okta credentials while
- CVEPAN-OS GlobalProtect accepts forged authentication override cookies
GlobalProtect portals and gateways with authentication override cookies enabled could be tricked into opening a VPN session without a login or MFA. Qilin and IN
- CVESimpleHelp accepts unsigned OIDC tokens, MFA bypass
SimpleHelp through 5.5.15 (and 6.0 pre-release) accepted OIDC ID tokens without signature verification, including alg:none. A forged token bypasses MFA. Patch i
- CVEVault login MFA rate-limit bypass and TOTP reuse
Vault's login MFA rate limits could be bypassed and TOTP codes reused, weakening the second factor. Part of the 2025 VaultFault set with the LDAP MFA bypass in
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- ExpertEditor, OAuth 2.0 (RFC 6749)
Dick Hardt edited RFC 6749, the OAuth 2.0 Authorization Framework, the document nearly every modern login flow rests on. He founded Sxip Identity in 2003, was a