DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55785: CVE-2026-55785: Non-Constant-Time Cryptographic Comparison and Sensitive Information Leakage in free5GC AUSF

#security #cve #cybersecurity

CVE-2026-55785: Non-Constant-Time Cryptographic Comparison and Sensitive Information Leakage in free5GC AUSF

Vulnerability ID: CVE-2026-55785
CVSS Score: 3.7
Published: 2026-08-28

free5GC is an open-source implementation of the 5G core network. Prior to version 1.4.5, the Authentication Server Function (AUSF) component of free5GC performs cryptographic comparisons within its Service-Based Interface (SBI) handling logic using non-constant-time helpers. These comparison utilities return immediately upon encountering a mismatching character, creating a covert timing channel. Concurrently, the AUSF writes the expected validation vector to standard output logs at the INFO level, exposing sensitive cryptographic material to unauthorized processes or logging agents.

TL;DR

The free5GC AUSF component prior to version 1.4.5 leaks expected authentication secrets in plaintext console logs and verifies user authentication responses using non-constant-time operations, allowing potential credential recovery.

Technical Details

  • CWE Identifier: CWE-208: Observable Timing Discrepancy
  • Secondary CWE: CWE-532: Insertion of Sensitive Information into Log File
  • Attack Vector: Network
  • CVSS v3.1 Score: 3.7
  • Exploit Status: none
  • CISA KEV Status: Not Listed

Affected Systems

  • free5gc AUSF
  • ausf: < 1.4.5 (Fixed in: 1.4.5)

Code Analysis

Commit: 7a5a4aa

Replace non-constant-time comparison routines with secure subtle.ConstantTimeCompare operations and remove sensitive parameter log statements.

--- a/internal/sbi/processor/ue_authentication.go
+++ b/internal/sbi/processor/ue_authentication.go
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade the free5GC core to version 1.4.5 or newer to implement constant-time comparison wrappers.
  • Configure standard logging aggregation engines to filter out any lines containing 'XresStar' or 'res*'.
  • Limit authorization logs in production deployments of free5gc-ausf to WARN or ERROR levels.

Remediation Steps:

  1. Navigate to the free5GC installation repository and checkout version v1.4.5 or later.
  2. Rebuild the AUSF microservice using the Go toolchain to incorporate the crypto/subtle code changes.
  3. Update your ausfcfg.yaml configurations to restrict the logging level of Auth5gAkaLog and AuthELog.
  4. Examine centralized SIEM index systems and purge any logged authentication vectors that were written prior to upgrading.

References

Read the full report for CVE-2026-55785 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)