TEAP (RFC 7170) is an EAP method used for network access authentication. Its Crypto-Binding TLV carries message authentication codes that tie the inner authentication to the outer TLS tunnel. In FreeRADIUS 3.2.10 the server could accept a client without verifying those MACs.
The problem
In the TEAP module of FreeRADIUS 3.2.10 the check of the Crypto-Binding data a peer sends existed only as a debug assertion, not as a run-time check. A peer that sent invalid Crypto-Binding data was therefore not rejected, and the server could accept the client without verifying any MAC.
How it was shown
The behaviour was reproduced on release 3.2.10 and reported to the developers. No details beyond the fix commit are published here.
Response
The developers fixed it in commit ff26d226 ("convert debug assertion to run-time check. If the peer sends invalid Crypto-Binding data, then reject it."), dated 31 Oct 2026 (JST), and credited the report in the commit message. As of 6 Nov 2026 the latest tagged release is 3.2.10 (June 2026), so the fix is in the development branch and not yet in a release.
Links
Cite as
Nobuo Otoi (ba-cybersecurity.com). FreeRADIUS: TEAP could accept a client without verifying any MAC (report and fix). 2026. https://ba-cybersecurity.com/research/freeradius-teap/.
@misc{otoi2026freeradius,
author = {Otoi, Nobuo},
title = {FreeRADIUS: TEAP could accept a client without verifying any MAC (report and fix)},
year = {2026},
howpublished = {\url{https://ba-cybersecurity.com/research/freeradius-teap/}},
note = {Fix: https://github.com/FreeRADIUS/freeradius-server/commit/ff26d226bfc2}
}
Reported and fixed 31 Oct 2026 (JST) · This page: updated 7 Nov 2026 · Permanent address: https://ba-cybersecurity.com/research/freeradius-teap/