Start with Identity
Subscribe
Identity CVE · RADIUS

CVE-2024-3596Blast-RADIUS, MD5 collision forges Access-Accept

critical · CVSS 9.0
Product: RADIUS (RFC 2865)Vendor: Protocol-wideCWE-328Disclosed: 2024-07-09Status: OngoingNVD ↗

What broke

RADIUS (RFC 2865) authenticates responses with an MD5-based Response Authenticator. A chosen-prefix collision lets an on-path attacker turn Access-Reject into Access-Accept. CHAP and PAP without Message-Authenticator are the easy cases. MFA that sits behind that RADIUS exchange is bypassed, because the NAS never sees the reject. CVSS 9.0. The research name is Blast-RADIUS. Vendor patching continued into 2026 (Schneider, among others, in April 2026).

Why it matters

RADIUS is still how VPN, Wi-Fi, and a surprising amount of MFA talk to the IdP. A protocol-level forge is an MFA bypass that does not care which vendor sold you the token. This is why we keep a 2024 CVE in a 2025-2026 catalog: the control (Message-Authenticator or RadSec) is what is still missing.

What to do

  • Require Message-Authenticator on every RADIUS client and server. Reject packets that omit it.
  • Move to RadSec (RADIUS over TLS) where the NAS supports it.
  • Stop sending PAP/CHAP across a network you do not trust. Prefer EAP methods that bind to TLS.
  • Inventory MFA products that still front RADIUS. A "phishing-resistant" factor behind a forgeable Access-Accept is not phishing-resistant.

Sources

  • NVD: CVE-2024-3596
  • Blast-RADIUS research (2024) and follow-on vendor advisories through 2026

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.