CVE-2026-55784

Received Received - Intake

Race Condition in free5GC AUSF Authentication Handling

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only by SUPI. Every request handled by internal/sbi/processor/ue_authentication.go creates an AusfUeContext, and AddAusfUeContextToPool executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), unconditionally replacing the active context for that SUPI. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, causing all attempts to share one logical authentication context URL while K_aut, XRES, and EapID are repeatedly overwritten. A valid EAP-AKA' response for an earlier challenge is then checked against the latest context, causing AT_MAC verification to fail and denying authentication to the selected subscriber while the request flood continues. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55784

Affected Vendors & Products

Vendor	Product	Version / Range
free5gc	free5gc	to 1.4.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability in free5GC versions 1.4.4 and earlier allows an attacker to disrupt subscriber authentication by exploiting a flawed context storage mechanism in the AUSF component. The system stores authentication state in a global map keyed only by SUPI, and concurrent requests for the same SUPI overwrite each other's context, causing authentication failures.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual patterns in AUSF SBI/N12 interface traffic. Look for excessive POST requests to /nausf-auth/v1/ue-authentications for the same SUPI. Check for repeated overwrites of authentication contexts in AUSFContext.UePool. Monitor for failed AT_MAC verifications due to mismatched EAP-AKA' responses.

Impact Analysis

If exploited, this vulnerability could deny legitimate subscribers access to network services by causing their authentication requests to fail. It may also enable denial-of-service conditions if attackers flood the system with concurrent requests for targeted SUPIs.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing subscriber authentication data through unauthorized access to the AUSF SBI/N12 interface. The flaw allows attackers to manipulate authentication contexts, which may lead to unauthorized access or denial of service for legitimate subscribers.

Mitigation Strategies

Immediately restrict access to the AUSF SBI/N12 interface to trusted sources only. Implement rate limiting on POST /nausf-auth/v1/ue-authentications requests per SUPI. Add validation to prevent concurrent authentication attempts from overwriting contexts. Monitor logs for repeated authentication failures and SUPI-based request floods.

Hi! I’m here to help you understand CVE-2026-55784. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70