Executive brief
Magma is an open-source platform for building mobile networks and managing 5G infrastructure. A vulnerability in the Access Gateway's authentication message handler allows attackers to bypass integrity protection by declaring unsupported security capabilities, potentially enabling message replay attacks and authentication bypass in 5G networks.
Technical details
The vulnerability exists in the SecurityModeComplete handler of Magma's Access Gateway (AGW) AMF component, which fails to properly validate UE-declared integrity algorithm capabilities. During 5G initial registration, a UE can declare support for only IA0 (no integrity algorithm), which the AMF incorrectly accepts and allows to proceed with a zero MAC value, violating 3GPP specifications. This is an improper validation vulnerability affecting a critical authentication handshake component. The attack is remotely triggered via crafted NAS packets during the initial registration flow and requires no authentication. The exploit is publicly available. Patch status is unknown from the advisory.
Affected products
- Linux Foundation Magma 1.9.0
Timeline
- 2026-07-15: disclosed
- 2026-08-30: advisory