free5GC up to 1.4.4 AUSF ue_authentication.go timing discrepancy

Summaryinfo

A vulnerability was found in free5GC up to 1.4.4. It has been rated as problematic. The affected element is the function Auth5gAkaComfirmRequestProcedure/EapAuthComfirmRequestProcedure of the file internal/sbi/processor/ue_authentication.go of the component AUSF. Performing a manipulation results in timing discrepancy. This vulnerability was named CVE-2026-55785. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic has been found in free5GC up to 1.4.4. This affects the function Auth5gAkaComfirmRequestProcedure/EapAuthComfirmRequestProcedure of the file internal/sbi/processor/ue_authentication.go of the component AUSF. The manipulation with an unknown input leads to a timing discrepancy vulnerability. CWE is classifying the issue as CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. This is going to have an impact on confidentiality. The summary by CVE is:

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-55785 since 06/17/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 1.4.5 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• free5GC

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4

Website

• Product: https://github.com/free5gc/free5gc/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion