CVE-2025-66719

An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access token with any arbitrary scope.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/free5gc/free5gc/issues/736	Exploit Issue Tracking
https://github.com/free5gc/nrf/pull/73	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:free5gc:nrf:1.4.0:*:*:*:*:*:*:*

History

17 Jun 2026, 09:57

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en Free5gc NRF 1.4.0. En la lógica de generación de tokens de acceso de free5GC, la función AccessTokenScopeCheck() en el archivo internal/sbi/processor/access_token.go omite toda la validación de alcance cuando el atacante utiliza un valor targetNF manipulado. Esto permite a los atacantes obtener un token de acceso con cualquier alcance arbitrario.

11 Feb 2026, 19:55

Type	Values Removed	Values Added
CPE		cpe:2.3:a:free5gc:nrf:1.4.0:::::::*
First Time		Free5gc nrf Free5gc
References	~~() https://github.com/free5gc/free5gc/issues/736 -~~	() https://github.com/free5gc/free5gc/issues/736 - Exploit, Issue Tracking
References	~~() https://github.com/free5gc/nrf/pull/73 -~~	() https://github.com/free5gc/nrf/pull/73 - Issue Tracking, Patch

23 Jan 2026, 20:15

Type	Values Removed	Values Added
CWE		CWE-863
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.1

23 Jan 2026, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-23 16:15

Updated : 2026-06-17 09:57

NVD link : CVE-2025-66719

Mitre link : CVE-2025-66719

CVE.ORG link : CVE-2025-66719

JSON object : View

Products Affected

free5gc

nrf

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-66719", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66719", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T19:23:17.121406Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-01-23T16:15:51.220", "references": [{"url": "https://github.com/free5gc/free5gc/issues/736", "tags": ["Exploit", "Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://github.com/free5gc/nrf/pull/73", "tags": ["Issue Tracking", "Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access token with any arbitrary scope."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Free5gc NRF 1.4.0. En la l\u00f3gica de generaci\u00f3n de tokens de acceso de free5GC, la funci\u00f3n AccessTokenScopeCheck() en el archivo internal/sbi/processor/access_token.go omite toda la validaci\u00f3n de alcance cuando el atacante utiliza un valor targetNF manipulado. Esto permite a los atacantes obtener un token de acceso con cualquier alcance arbitrario."}], "lastModified": "2026-06-17T09:57:11.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:free5gc:nrf:1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C9EFD5D-FC88-49B3-B73F-500B144CB4D2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}