Is CVE-2025-66719 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66719 being exploited in the wild.

How severe is CVE-2025-66719?

Critical severity, with a CVSS score of 9.1, published 23 January 2026.

Which products and versions are affected?

free5GC NRF 1.4.0; github.com/free5gc/nrf (Go) < 1.4.1, SEMVER:introduced=0,fixed=1.4.1.

Is there a fix for CVE-2025-66719?

Yes. github.com/free5gc/nrf (Go): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-66719 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-66719?

Check whether you run free5GC NRF or github.com/free5gc/nrf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66719: Free5gc NRF scope validation bypass in access-token generation

Q: Is there a fix for CVE-2025-66719?

Yes. github.com/free5gc/nrf (Go): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-66719 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-66719?

Check whether you run free5GC NRF or github.com/free5gc/nrf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66719 · Severity: critical · CVSS 9.1 · Published 2026-01-23

Free5gc NRF, a core component of 5G mobile networks used for managing network functions, contains a security flaw in how it validates access requests. An attacker can bypass security checks by providing a specially crafted value, allowing them to obtain unauthorized access tokens. This could lead to unauthorized control over network services and potential exposure of sensitive mobile network data.

Technologies: free5GC NRF, github.com/free5gc/nrf (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2025-66719 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66719 being exploited in the wild.
How severe is CVE-2025-66719?: Critical severity, with a CVSS score of 9.1, published 23 January 2026.
Which products and versions are affected?: free5GC NRF 1.4.0; github.com/free5gc/nrf (Go) < 1.4.1, SEMVER:introduced=0,fixed=1.4.1.
Is there a fix for CVE-2025-66719?: Yes. github.com/free5gc/nrf (Go): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66719 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-66719?: Check whether you run free5GC NRF or github.com/free5gc/nrf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/free5gc/nrf (Go): upgrade to 1.4.1 or later
```
go get github.com/free5gc/nrf@v1.4.1
```

Technical details

An incorrect authorization vulnerability (CWE-863) exists in Free5gc NRF version 1.4.0. The AccessTokenScopeCheck() function within internal/sbi/processor/access_token.go fails to properly validate scopes when a maliciously crafted targetNF value is provided. A remote, unauthenticated attacker can exploit this over the network to bypass all scope validation logic. Successful exploitation allows the attacker to generate access tokens with any arbitrary scope, leading to a complete compromise of confidentiality and integrity within the affected 5G core network environment. The issue is addressed in version 1.4.1.

Affected products

Free5gc NRF 1.4.0

Identifiers

CVE-2025-66719
GHSA-q7c8-gfjh-8v4p
GO-2026-5570

Timeline

2026-01-23: disclosed
2026-01-23: advisory
2026-06-05: patched: Advisory updated to reflect patch in 1.4.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.