Critical · published January 23, 2026
🚨 Crafting the right targetNF value is all it takes to bypass scope validation in Free5gc's access-token generation — a surprisingly easy way for attackers to secure a token with any arbitrary permissions! 🔥 Think of it like a restaurant that gives out keys to the pantry without checking if you should even be in there — one crafty request and suddenly the entire menu is at your fingertips! An attacker could gain unrestricted access to sensitive resources by simply manipulating the targetNF value, leading to a catastrophic breach of data security. This means they could wield the power to access or modify anything they want within the system, creating havoc and potential data loss.
Think of it like a restaurant that gives out keys to the pantry without checking if you should even be in there — one crafty request and suddenly the entire menu is at your fingertips! In Free5gc version 1.4.0, the AccessTokenScopeCheck() function fails to validate the provided targetNF effectively, allowing attackers to generate access tokens with any scope they desire, bypassing all intended restrictions.
An attacker could gain unrestricted access to sensitive resources by simply manipulating the targetNF value, leading to a catastrophic breach of data security. This means they could wield the power to access or modify anything they want within the system, creating havoc and potential data loss. Immediately update Free5gc to version 1.4.1 or later to patch this critical vulnerability. Additionally, review access control mechanisms to ensure robust validation of token scopes going forward. 🔒 This is fixable! Get that patch in place, and you’ll be a security hero in no time! 🦸♂️