The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade the Okta RADIUS Agent to version 2.28.0 or greater.
Workaround
No workaround given by the vendor.
References
History
Tue, 13 Oct 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token. | |
| Title | Insecure Default File Permissions in Okta RADIUS Agent Windows Installer | |
| Weaknesses | CWE-732 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Okta
Published:
Updated: 2026-10-13T20:17:04.587Z
Reserved: 2026-08-24T22:04:00.475Z
Link: CVE-2026-78632
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-13T21:18:21.747
Modified: 2026-10-13T21:18:21.747
Link: CVE-2026-78632
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses