Unauthorized Access in free5GC NEF Mounting Prior to Version 4.2.2

CVE-2026-44320

What is CVE-2026-44320?

The vulnerability in free5GC's Network Exposure Function (NEF) allows unauthorized access due to the improper handling of OAuth2/bearer-token authorization. Specifically, prior to version 4.2.2, the NEF mounts the nnef-callback route group without the necessary inbound authorization checks. This oversight permits attackers to use forged or arbitrary bearer tokens to access the SMF-callback handler. Consequently, malicious actors can bypass authentication boundaries, interacting with subscription states by exploiting known NotifIds. This issue arises from a lack of middleware safeguards and allows attackers to send crafted callbacks that can affect legitimate operations.

References