CVE-2004-2163: OpenBSD

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, which allows remote attackers to bypass authentication by spoofing server replies.

Affected products

• OpenBSD OpenBSD: version 3.2 only; version 3.4 only; version 3.5 only

Published 2004-12-31. Last modified 2026-06-16.