Executive brief
The Network Exposure Function (NEF) in the free5GC 5G core framework fails to require authentication for its Operations, Administration, and Maintenance (OAM) interface. This component is responsible for exposing network capabilities to external applications. An attacker with network access could interact with administrative functions without a password or security token, potentially leading to unauthorized monitoring or control of the 5G network infrastructure.
Technical details
The free5GC Network Exposure Function (NEF) contains a structural authentication bypass in its Service Based Interface (SBI). The `nnef-oam` route group is mounted without the necessary OAuth2/bearer-token middleware, even when OAuth2 is globally enabled. This allows a remote, unauthenticated attacker to reach OAM handlers by omitting the Authorization header. While the current OAM handler is a stub, the vulnerability is route-group-scoped, meaning any future administrative or operational functions added to this group will be exposed without authentication by default. This has been assigned CWE-306 (Missing Authentication) and CWE-862 (Missing Authorization).
Affected products
- free5GC nef <= 1.2.3
Timeline
- 2026-03-11: other: Vulnerability validated in Docker lab environment
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-27: other: NVD publication date