CVE-2025-66719 — Vulnerability in github.com/free5gc/nrf — CVE Details

CRITICAL

Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value

Published January 23, 2026Updated July 7, 2026Source: osv

Summary

An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access token with any arbitrary scope.

Advisory Timeline

First published January 23, 2026 (262 days ago).
Last revised July 7, 2026 — 165 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/free5gc/nrf to 1.4.1 or later

go get github.com/free5gc/nrf@v1.4.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
github.com/free5gc/nrf	go	All versions	1.4.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-863
Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2025-66719?: Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2025-66719?: CVE-2025-66719 affects github.com/free5gc/nrf. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-66719 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-q7c8-gfjh-8v4p

GO-2026-5570

Related CVEs

CVE-2026-44329
CRITICAL
free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
CVE-2026-44326
CRITICAL
free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions
CVE-2026-44315
CRITICAL
free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
CVE-2026-44327
CRITICAL
free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
CVE-2026-107806
CRITICAL
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CVE-2026-68582
CRITICAL
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CVE-2026-44330
CRITICAL
free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
CVE-2026-55068
CRITICAL
free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies