Executive brief
Magma is an open-source mobile core network platform used by telecommunications providers to manage 5G infrastructure. A flaw in the Authentication and Mobility Management Function (AMF) allows attackers to bypass authentication by sending specific NGAP protocol messages, potentially gaining unauthorized access to the network without establishing proper security credentials. This could enable denial of service, unauthorized network access, or further compromise of network services.
Technical details
The vulnerability is an improper authentication flaw in the Registration Complete message handler within the AMF finite state machine (amf_fsm.cpp). The root cause is that the AMF component accepts a Registration Complete message (sent via UplinkNASTransport) immediately after receiving an InitialUEMessage, without requiring prior completion of mandatory authentication and security mode establishment procedures. An attacker on the network can craft and send a sequence of NGAP messages to trigger an improper state transition from COMMON_PROCEDURE_INITIATED to REGISTERED_CONNECTED without authentication, bypassing security context establishment. This results in an authentication bypass and can trigger a denial of service crash in the MME/AMF. The vulnerability affects Magma 1.9.0 and is remotely exploitable; patches or fixes are not yet detailed in available sources.
Affected products
- Linux Foundation Magma 1.9.0
Timeline
- 2026-07-15: disclosed: Bug report opened on GitHub
- 2026-08-30: other: CVE published / advisory published