OpenAirInterface v2.2.0 accepts a Security Mode Complete message even when no integrity protection has been negotiated, allowing the security context to be downgraded to IA0. This weakness can be exploited to replay previously recorded registration or control messages, potentially enabling an attacker to re‑establish a connection or act as an authorized user. The flaw is a classic integrity bypass that maps to CWE‑294, compromising the authenticity and non‑repudiation of messages.

The affected product is the OpenAirInterface CN5G AMF (oai-cn5g-amf) version 2.2.0, deployed in 5G core networks.

The vulnerability carries a CVSS score of 7.5, indicating a high risk, but the EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. Attackers would need the ability to send crafted Security Mode Complete messages to the AMF, typically from an UE or a compromised device within the same network. If they succeed, they can replay authentication or registration data to force the AMF into an insecure state.