CVE-2026-55785

Received Received - Intake

Authentication Material Exposure in free5GC AUSF

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55785

Affected Vendors & Products

Vendor	Product	Version / Range
free5gc	free5gc	to 1.4.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-385	Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

The vulnerability in free5GC before version 1.4.5 involves insecure cryptographic comparisons in the AUSF component. The AUSF uses weak equality checks for authentication tokens (RES*, XRES*, AT_MAC, XMAC) which can lead to timing side channels. Additionally, sensitive authentication material (XRES*) is logged at INFO level before comparison, exposing it to unauthorized parties with log access.

Detection Guidance

Check if your free5GC version is below 1.4.5. Inspect AUSF logs for exposed authentication material like XRES* or AT_MAC values. Look for INFO level logs containing sensitive authentication data before comparison.

Impact Analysis

An attacker could exploit timing differences in authentication responses to infer valid credentials. The exposed XRES* in logs may allow unauthorized parties to recover authentication secrets. While HTTP/SBI timing noise limits practical exploitation, the log exposure poses a risk to operators and systems relying on free5GC for 5G authentication.

Compliance Impact

The vulnerability exposes authentication material (RES*, XRES*, AT_MAC, XMAC) in AUSF logs at INFO level, which could lead to unauthorized access to sensitive data. This may violate GDPR's data protection principles and HIPAA's safeguards for protected health information if logs are mishandled or exposed.

Mitigation Strategies

Upgrade free5GC to version 1.4.5 or later. Restrict access to AUSF logs to prevent exposure of authentication material. Monitor logs for unauthorized access to sensitive authentication data.

Hi! I’m here to help you understand CVE-2026-55785. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70