In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registration procedure. This allows authentication to be bypassed completely. If a SecurityModeComplete message is sent after InitialUERegistration, a registration reject is received followed by a registration accept! This leads the UE to be registered without proper authentication.
References
| Link | Resource |
|---|---|
| https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/77 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
14 Apr 2026, 15:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:openairinterface:oai-cn5g-amf:2.2.0:*:*:*:*:*:*:* | |
| First Time |
Openairinterface oai-cn5g-amf
Openairinterface |
|
| References | () https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/77 - Exploit, Issue Tracking, Third Party Advisory |
09 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-288 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
07 Apr 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-07 15:17
Updated : 2026-04-14 15:45
NVD link : CVE-2026-30079
Mitre link : CVE-2026-30079
CVE.ORG link : CVE-2026-30079
JSON object : View
Products Affected
openairinterface
- oai-cn5g-amf
CWE
CWE-288
Authentication Bypass Using an Alternate Path or Channel