CVE-2026-30079: OpenAirInterface AMF Auth Bypass Flaw

CVE-2026-30079 Overview

CVE-2026-30079 is an authentication bypass vulnerability in OpenAirInterface V2.2.0 Access and Mobility Management Function (AMF). The vulnerability exists due to improper handling of out-of-sequence messages during the User Equipment (UE) registration procedure, which causes incorrect state transitions. This flaw allows attackers to completely bypass authentication by sending messages in an unexpected order.

When a SecurityModeComplete message is sent after InitialUERegistration, the system incorrectly processes the sequence, resulting in a registration reject followed by a registration accept. This flawed state machine behavior allows a UE to be registered without completing proper authentication procedures.

Critical Impact

This vulnerability allows complete authentication bypass in 5G core network infrastructure, enabling unauthorized devices to register on the network without proper security validation.

Affected Products

• OpenAirInterface V2.2.0 AMF
• OAI 5G Core Network AMF component

Discovery Timeline

• 2026-04-07 - CVE-2026-30079 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-30079

Vulnerability Analysis

This vulnerability represents an Authentication Bypass using an Alternate Path or Channel (CWE-288). The OpenAirInterface AMF component fails to properly enforce the expected sequence of messages during the UE registration procedure defined by 3GPP standards.

In a legitimate 5G registration flow, the AMF must process messages in a specific order: InitialUERegistration, followed by authentication challenges and responses, before proceeding to SecurityModeCommand and finally SecurityModeComplete. The vulnerable implementation does not properly validate message ordering, allowing an attacker to skip critical authentication steps.

The state machine implementation accepts a SecurityModeComplete message prematurely, triggering an incorrect state transition. Despite initially sending a registration reject, the flawed logic subsequently issues a registration accept, effectively granting network access to an unauthenticated device.

Root Cause

The root cause is an improper state machine implementation within the AMF's UE context handling. The system fails to validate that all prerequisite authentication steps have been completed before transitioning to a registered state. This represents a fundamental flaw in the message sequence validation logic that should enforce strict ordering of 5G NAS (Non-Access Stratum) procedures.

Attack Vector

The attack exploits the network-accessible AMF interface by manipulating the order of NAS messages during the registration procedure:

1. An attacker initiates a UE registration by sending an InitialUERegistration message
2. Instead of following the standard authentication exchange, the attacker immediately sends a SecurityModeComplete message
3. The AMF's faulty state machine processes this out-of-sequence message
4. The system initially responds with a registration reject
5. Due to the state corruption, the system subsequently sends a registration accept
6. The attacker's device is now registered on the network without authentication

This attack requires network-level access to communicate with the AMF but requires no authentication or user interaction, making it particularly dangerous for 5G infrastructure deployments.

Detection Methods for CVE-2026-30079

Indicators of Compromise

• Anomalous NAS message sequences where SecurityModeComplete arrives before authentication completion
• UE registrations that show both reject and accept responses in rapid succession
• Increased registration attempts from unrecognized IMSIs or SUPIs
• State machine error logs indicating unexpected message types during registration

Detection Strategies

• Implement deep packet inspection for 5G NAS protocol messages to identify out-of-sequence message patterns
• Deploy monitoring for registration procedures that bypass authentication challenges
• Create alerts for registration accept messages that follow registration reject for the same UE context
• Audit AMF logs for unusual state transitions during registration procedures

Monitoring Recommendations

• Enable detailed logging of all NAS message exchanges during UE registration
• Monitor for spikes in failed authentication attempts followed by successful registrations
• Implement network behavior analysis to detect unauthorized device registrations
• Review AMF state machine transitions for anomalous patterns

How to Mitigate CVE-2026-30079

Immediate Actions Required

• Upgrade OpenAirInterface AMF to a patched version when available
• Implement network segmentation to restrict access to AMF interfaces
• Enable enhanced logging on AMF components to detect exploitation attempts
• Review and audit all currently registered UEs for potential unauthorized access

Patch Information

The vulnerability has been reported and tracked in GitLab Issue #77. Organizations should monitor this issue for patch availability and apply updates as soon as they are released.

Workarounds

• Implement strict firewall rules to limit access to AMF interfaces to trusted network elements only
• Deploy an application-layer gateway that validates NAS message sequences before forwarding to the AMF
• Consider deploying additional authentication mechanisms at the network edge while awaiting a patch
• Implement rate limiting on registration attempts to slow potential exploitation