CVE-2024-3596Blast-RADIUS, MD5 collision forges Access-Accept

What broke

RADIUS (RFC 2865) authenticates responses with an MD5-based Response Authenticator. A chosen-prefix collision lets an on-path attacker turn Access-Reject into Access-Accept. CHAP and PAP without Message-Authenticator are the easy cases. MFA that sits behind that RADIUS exchange is bypassed, because the NAS never sees the reject. CVSS 9.0. The research name is Blast-RADIUS. Vendor patching continued into 2026 (Schneider, among others, in April 2026).

Why it matters

RADIUS is still how VPN, Wi-Fi, and a surprising amount of MFA talk to the IdP. A protocol-level forge is an MFA bypass that does not care which vendor sold you the token. This is why we keep a 2024 CVE in a 2025-2026 catalog: the control (Message-Authenticator or RadSec) is what is still missing.

What to do

• Require Message-Authenticator on every RADIUS client and server. Reject packets that omit it.
• Move to RadSec (RADIUS over TLS) where the NAS supports it.
• Stop sending PAP/CHAP across a network you do not trust. Prefer EAP methods that bind to TLS.
• Inventory MFA products that still front RADIUS. A "phishing-resistant" factor behind a forgeable Access-Accept is not phishing-resistant.

After you patch

RADIUS carries authentication for network and VPN access, and its legacy cryptography is the recurring weakness rather than any single implementation.

• Rotate every shared secret, using long random values that differ per client rather than a single reused string.
• Move RADIUS traffic inside an authenticated transport, RADIUS over TLS or IPsec, so the protocol's own integrity weaknesses stop being reachable.
• Prefer EAP methods with mutual authentication over PAP or CHAP wherever the client supports it.
• Audit which devices still authenticate over RADIUS and what they grant, since network gear and VPN concentrators are common initial-access targets. See MFA.

Sources

• NVD: CVE-2024-3596
• Blast-RADIUS research (2024) and follow-on vendor advisories through 2026