This vulnerability in Open5GS (up to version 2.7.7) involves the ogs_sbi_xact_add function within the /lib/core/ogs-timer.c library, specifically in the ue-authentications endpoint component. Remote manipulation of this function can lead to denial of service. The CVSS 4.0 base score is 5.3, indicating medium severity, with attack vector network, low attack complexity, and no privileges or user interaction required. The vulnerability was published on 2026-05-30, and a public exploit is available. However, no official patch or remediation guidance has been provided by the vendor or authoritative sources.

Successful exploitation results in denial of service, potentially disrupting the availability of the Open5GS service related to UE authentication. This could impact network operations relying on Open5GS for 5G core network functions. There is no indication of privilege escalation, data confidentiality, or integrity impact. The existence of a public exploit increases the likelihood of attacks, but no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Applying a patch is recommended once available. Until then, monitoring for unusual activity related to UE authentication and restricting access to the affected service components may help reduce risk. Avoid relying on untrusted inputs that could trigger the vulnerability.