External risk intelligence

OpenAirInterface AMF Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-30079

The vulnerability exists in the Access and Mobility Management Function (AMF) of a 5G core network. The AMF is a public-facing, foundational component of the 5G architecture designed to handle UE (User Equipment) registration and authentication processes directly from the network edge.

Openairinterface Oai Cn5g Amf

2.2.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the OpenAirInterface Access and Mobility Management Function could allow an attacker to bypass authentication and register devices without proper validation. This issue affects the core network's ability to secure device access. The main concern at this time is confirming relevance and exposure.

Unauthenticated device registration is possible.
Secures critical 5G core network access control.
Confirm if your network is exposed.

Attack Path

How an attacker could exploit the issue

An attacker can target the OpenAirInterface AMF by sending specially crafted network messages. By manipulating the order of these messages during the User Equipment (UE) registration process, an attacker can trick the system into believing the UE is registered without completing the necessary authentication steps. This bypass allows an unauthenticated UE to gain access to the network.

Entry condition: Network exposure.
Trigger point: Out-of-sequence registration messages.
Resulting risk: Authentication bypass and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized user equipment to register with the network without completing the standard authentication process. This occurs when out-of-sequence messages are sent during the UE registration procedure, specifically if a SecurityModeComplete message arrives after an InitialUERegistration, leading to an incorrect state transition where a registration reject is followed by a registration accept.

Unauthorized network access for user equipment.
Authentication bypass via message sequencing.
Compromised network integrity and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the OpenAirInterface AMF impacts the integrity of user authentication, directly affecting the security posture of 5G core networks. Teams responsible for network infrastructure and security operations, including those managing the OpenAirInterface components, should prioritize understanding the exposure. The initial step involves identifying all deployments of the affected AMF, confirming network reachability and business criticality, and then assigning ownership for remediation planning based on assessed risk.

Own the issue: Infrastructure and Security teams.
Verify first: AMF deployment reachability and criticality.
Action: Plan and execute authentication bypass risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the oai-cn5g-amf software?

The oai-cn5g-amf is the Access and Mobility Management Function within the OpenAirInterface 5G core network suite. It acts as the primary gatekeeper for mobile devices, or User Equipment (UE), connecting to the network. It manages crucial tasks like registration, connection management, and authentication to ensure only authorized devices gain network access.

What does CWE-288 mean for CVE-2026-30079?

CWE-288 refers to Authentication Bypass Using an Alternate Path or Channel. In the context of this vulnerability, it means the system's logic can be manipulated to skip the mandatory security verification step. By exploiting how the AMF processes message sequences, the system inadvertently grants access to a device as if it were fully authenticated, even though the actual security handshake never successfully occurred.

How is the CVE-2026-30079 vulnerability triggered?

The vulnerability is triggered by sending out-of-sequence network messages during a device registration attempt. Specifically, the system enters an incorrect state if a SecurityModeComplete message is received after an InitialUERegistration request. Note that standard, correctly sequenced registration requests do not trigger this error; the system only fails when it receives these messages in the specific, improper order that confuses the registration logic.

Is my network at risk for CVE-2026-30079?

According to Halo Surface Signal, this vulnerability resides in a core component designed to interface directly with the network edge to handle device connections. Because the AMF is a foundational, public-facing part of the 5G architecture, any deployment where this service is reachable over the network is considered to have a higher potential for exposure.

Do I need to patch my OpenAirInterface AMF?

You should begin by verifying your current infrastructure to identify every deployment of the affected version (2.2.0). Since this flaw affects core authentication integrity, prioritize mapping which AMF instances are network-reachable versus those in isolated segments. After identifying these assets, coordinate with your infrastructure team to plan for updates that address this authentication logic flaw.

References

gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/77

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.