CVE-2026-55784

Name of the Vulnerable Software and Affected Versions free5GC versions 1.4.4 and earlier

Description The AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool within internal/context/context.go, using only the SUPI as a key. Requests processed by internal/sbi/processor/ue authentication.go create an AusfUeContext, and the AddAusfUeContextToPool() function executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), which unconditionally replaces the active context for that SUPI. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST requests to the '/nausf-auth/v1/ue-authentications' endpoint for the same target SUPI. This causes multiple attempts to share one logical authentication context URL while K aut, XRES, and EapID are repeatedly overwritten. Consequently, a valid EAP-AKA' response for an earlier challenge is verified against the most recent context, leading to AT MAC verification failure and denying authentication to the subscriber during a request flood.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.