New Blast-RADIUS Attack Bypasses Popular RADIUS Authentication

Blast-RADIUS is a vulnerability and attack technique against the RADIUS protocol where an attacker performs a man-in-the-middle chosen-prefix MD5 collision to transform a legitimate Access-Reject into a forged Access-Accept by injecting a malicious Proxy-State attribute; this enables authentication bypass across numerous RADIUS deployments (PAP/CHAP/MS-CHAPv2 over UDP) affecting network devices, VPNs, Wi‑Fi/802.1X, roaming/mobile offload, and critical infrastructure. The report describes attack mechanics and recommends patching and secure RADIUS configuration as mitigation.