Log in Start free

Vulnerability · Published Aug 28, 2026 · Assigned by GitHub_M

CVE-2026-55785free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

Low 3.7

In plain English

A low-severity sensitive data in logs in free5gc from free5gc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 61.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/free5gc/ausf1.4.5GHSA-fp46-6vfw-gc9c
Gogithub.com/free5gc/ausf1.4.5GO-2026-6328

Affected products (as reported)

VendorProductVersions
free5gc free5gc < 1.4.5

Weakness: CWE-208, CWE-385, CWE-532 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References