# free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

free5GC AUSF keys EAP-AKA' auth contexts only by SUPI, so concurrent auth requests overwrite the context and break AT_MAC verification, denying authentication for a targeted subscriber.

- Payout: Research
- Severity: high
- Program: free5GC
- Found by: jaimealruiz, jav1er8
- Disclosed: 2026-08-28
- CVE: CVE-2026-55784
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-334q-h5g3-fpxv
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-334q-h5g3-fpxv
- Tags: area:devices domain:network impact:dos kind:research platform:ghsa sev:high tech:go technique:race-window technique:source-review vuln:auth-bypass vuln:dos vuln:race-condition

**Target:** AUSF SBI/N12 endpoint POST /nausf-auth/v1/ue-authentications and /eap-session
**Root cause:** AusfUeContext is stored in a global sync.Map keyed solely by SUPI with unconditional Store(), so each new authentication request replaces any in-progress context; the EAP response is later verified against the latest context's K_aut/XRES.
**Steps:**
1. Send `POST /nausf-auth/v1/ue-authentications` for target SUCI `suci-0-001-01-0-0-0-0000000002` to store ctx_LEGIT under UePool[supi].
2. Flood many concurrent `POST /nausf-auth/v1/ue-authentications` for the same SUCI; each returns 201 and overwrites the context with new K_aut/XRES.
3. Submit the legitimate EAP-AKA' response with AT_MAC computed from K_aut_LEGIT to `/nausf-auth/v1/ue-authentications/{suci}/eap-session`.
4. AUSF loads ctx_ATTACK by SUPI, computes XMAC with K_aut_ATTACK, AT_MAC check fails, returns EAP notification failure.
**How found:** Code review of internal/context/context.go and internal/sbi/processor/ue_authentication.go: noticed UePool is a sync.Map keyed only by SUPI and AddAusfUeContextToPool calls Store() unconditionally with no LoadOrStore guard, no session ID in the context URL, and no per-SUPI rate limit; then built a mock UDM returning distinct LEGIT/ATTACK vectors to make the overwrite observable.
**Exploitation:** Attacker with SBI/N12 access maintains a request flood for a chosen SUPI so the stored context keeps changing before the legitimate EAP response is processed; the response is validated against mismatched K_aut/XRES and rejected, denying authentication for that subscriber while the flood continues.
**Insight:** In 5G NF code, a sync.Map keyed by subscriber identity gives thread-safe map ops but not procedure-safe state: check whether the auth-session URL embeds a per-session ID or just the SUCI/SUPI, and whether Store() is guarded by LoadOrStore — if not, concurrent requests for one subscriber collapse onto one context.