free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI (CVE-2026-55784)

free5GC AUSF stores per-subscriber authentication state in a global sync.Map keyed solely by SUPI. Each incoming authentication request creates and stores a new AusfUeContext under the SUPI key without checking for existing authentication procedures or generating unique session identifiers. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST requests for the same SUPI, causing each new request to overwrite the previous authentication context. When the legitimate EAP-AKA' response arrives, it is verified against the overwritten context, causing integrity check failures and authentication denial of service. This flaw was confirmed in free5GC AUSF v1.4.4 and main branch as of June 2026.

An attacker can cause a targeted denial of service against a subscriber by flooding the AUSF with concurrent authentication requests for the same SUPI. This prevents the legitimate authentication response from succeeding because the authentication context is overwritten, causing verification failures. The vulnerability does not disclose information or allow privilege escalation but disrupts subscriber authentication availability.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, limit access to the AUSF SBI/N12 interface to trusted entities only and monitor for unusual concurrent authentication request patterns targeting the same SUPI to reduce risk.