# CVE-2026-55784: free5GC AUSF authentication context race condition

Source: https://junglewise.ai/threats/cve-2026-55784-free5gc-ausf-authentication-context-race-condition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55784 · Severity: high · CVSS 7.5 · Published 2026-08-28

The free5GC AUSF (Authentication Server Function) component manages 5G subscriber authentication. A race condition in how it stores per-subscriber authentication state allows an attacker to block a target subscriber from authenticating by flooding the system with concurrent requests for the same subscriber. During the attack, legitimate authentication attempts fail because the AUSF's stored security material (cryptographic keys and response values) is continuously overwritten by attacker-controlled requests, causing valid authentication responses to fail verification checks.

Technologies: [github.com/free5gc/ausf (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-ausf). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55784 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55784 being exploited in the wild.

**How severe is CVE-2026-55784?** High severity, with a CVSS score of 7.5, published 28 August 2026.

**Which products and versions are affected?** github.com/free5gc/ausf (Go) <= 1.4.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.4.

**Is there a fix for CVE-2026-55784?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55784 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55784?** Check whether you run github.com/free5gc/ausf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a race condition in subscriber authentication state management. The AUSF stores authentication context in a sync.Map with SUPI as the sole key; every incoming POST /nausf-auth/v1/ue-authentications request unconditionally replaces any existing context for that SUPI via a Store() call without checking for in-progress authentication or generating a unique session identifier. An attacker with network access to the AUSF SBI or N12 interface can flood concurrent authentication requests targeting the same SUPI. Each request obtains a new authentication vector (including K_aut, XRES, and EapID) and overwrites the stored context. When a legitimate EAP-AKA' response arrives, the AUSF retrieves the current (overwritten) context by SUPI and attempts MAC verification using the attacker-controlled K_aut, causing the authentication to fail even though the response was valid for the original challenge. No patched versions are currently available; the issue affects v1.4.4 and current main as of June 2026. Mitigation requires redesigning the session model to use unique session IDs instead of SUPI as the sole context key, or implementing atomic check-and-insert with explicit rejection of concurrent attempts.

## Affected products

- free5gc AUSF <= 1.4.4, current main as of June 2026

## Identifiers

- CVE-2026-55784
- GHSA-334q-h5g3-fpxv
- GO-2026-6326

## Timeline

- 2026-06-22: disclosed: Vulnerability confirmed on free5gc/ausf v1.4.4 and main branch
- 2026-08-28: advisory: GitHub Security Advisory GHSA-334q-h5g3-fpxv published
- 2026-05-27: other: Proof of concept demonstrated in controlled lab environment showing race condition and authentication failure

## References

- [https://api.github.com/users/jaimealruiz](https://api.github.com/users/jaimealruiz)
- [https://github.com/jaimealruiz](https://github.com/jaimealruiz)
- [https://api.github.com/users/jaimealruiz/gists%7B/gist_id%7D](https://api.github.com/users/jaimealruiz/gists%7B/gist_id%7D)
- [https://api.github.com/users/jaimealruiz/repos](https://api.github.com/users/jaimealruiz/repos)
- [https://avatars.githubusercontent.com/u/124803932?v=4](https://avatars.githubusercontent.com/u/124803932?v=4)
- [https://api.github.com/users/jaimealruiz/events%7B/privacy%7D](https://api.github.com/users/jaimealruiz/events%7B/privacy%7D)

## Related threats

- [free5GC AUSF non-constant-time authentication comparison and sensitive logging](https://junglewise.ai/threats/cve-2026-55785-free5gc-ausf-non-constant-time-authentication-comparison-and)
- [free5gc AUSF improper input validation in supiOrSuci field](https://junglewise.ai/threats/cve-2026-53551-free5gc-ausf-improper-input-validation-in-supiorsuci-field)
- [GO-2026-4754 - free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion in github.com/free5gc/ausf](https://junglewise.ai/threats/cve-2026-33063-free5gc-ausf-ue-authentication-panic-on-nil-sucisupimap-interface)