The Okta RADIUS Agent Windows installer grants write permissions on the agent configuration, AES encryption key, and log directories to the NT SERVICE\\ALL SERVICES and CREATOR OWNER security principals. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token, exposing credentials that could be used to authenticate to Okta services.

Okta RADIUS Agent installed on Windows systems is affected. Versions prior to the release of 2.28.0 contain the insecure permissions; upgrading to 2.28.0 or later resolves the issue.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the permissions impact local service accounts, the attack vector is local and requires that an attacker have local access to the host to read the compromised keys. An attacker who obtains the AES key and encrypted token could access Okta APIs with the compromised credentials, potentially expanding privileges within the organization.