TI-2026-40274 Aliases CVE-2026-55785 GHSA-fp46-6vfw-gc9c

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

LOW 18CWE-208Published 2026-08-28 · Updated 2026-08-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-208.

Summary

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00445 38th percentileScored 2026-11-07

Fix Fixed free5gc (free5gc): 1.4.5github.com/free5gc/ausf (Go): 1.4.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
free5gc	free5gc	before 1.4.5	1.4.5	Patch available	CNA
—	github.com/free5gc/ausf (Go)	before 1.4.5	1.4.5	Patch available	GHSA-fp46-6vfw-gc9c

free5gc Vendorfree5gc Affected before 1.4.5 Fixed in 1.4.5 Patch available CNA
github.com/free5gc/ausf (Go) Vendor— Affected before 1.4.5 Fixed in 1.4.5 Patch available GHSA-fp46-6vfw-gc9c

Remediation

Fix · CNA free5gc (free5gc) Fixed in 1.4.5
Fix · GHSA-fp46-6vfw-gc9c github.com/free5gc/ausf (Go) Fixed in 1.4.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-55785
2026-10-03 Alias added: GHSA-fp46-6vfw-gc9c

References

Other 5

TI-2026-32298 Incorrect authorization in free5gc CVSS 3.1CRITICAL 10.0
TI-2026-32297 free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers CVSS 3.1CRITICAL 10.0
TI-2026-32295 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler CVSS 3.1CRITICAL 10.0
TI-2025-39412 free5gc v4.1.0 and before is vulnerable to Buffer Overflow. CVSS 3.1CRITICAL 9.8
TI-2026-32294 Missing authorization in free5gc CVSS 3.1CRITICAL 9.4
TI-2026-32283 Missing authorization in free5gc CVSS 3.1CRITICAL 9.4

See all 86 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences