{"cve":"CVE-2026-44327","nvd":{"published":"2026-05-27T17:16:38.203","modified":"2026-10-14T20:10:00.190","status":"Analyzed","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-oam route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can hit the OAM route with no Authorization header at all and the handler returns 200 OK. The current OAM handler is a stub that returns null, but the structural defect is route-group-scoped: the entire OAM route group has no inbound auth middleware, so every future OAM operation added to this group inherits the missing auth boundary by default. This vulnerability is fixed in 4.2.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","score":10.0},"cwes":["CWE-306","CWE-862"],"references":["https://github.com/free5gc/free5gc/issues/861","https://github.com/free5gc/free5gc/security/advisories/GHSA-cmpj-2x3g-m7g3","https://github.com/free5gc/nef/pull/23","https://github.com/free5gc/free5gc/security/advisories/GHSA-cmpj-2x3g-m7g3"],"products":["free5gc:free5gc"],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-44327","score":0.00311,"percentile":0.23768,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-cmpj-2x3g-m7g3","url":"https://osv.dev/vulnerability/GHSA-cmpj-2x3g-m7g3","summary":"free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler","modified":"2026-07-21T13:57:54Z","packages":[{"ecosystem":"Go","name":"github.com/free5gc/nef","purl":"pkg:golang/github.com/free5gc/nef","ranges":["<=1.2.3"],"fixed":[]}]},{"id":"GO-2026-5326","url":"https://osv.dev/vulnerability/GO-2026-5326","summary":"free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler in github.com/free5gc/nef","modified":"2026-06-25T19:45:30.707219480Z","packages":[{"ecosystem":"Go","name":"github.com/free5gc/nef","purl":"pkg:golang/github.com/free5gc/nef","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}