The PCF Npcf_SMPolicyControl service fails to attach authentication middleware when registering its SM‑policy route group, which creates a classic authentication bypass (CWE‑862). As a result, HTTP requests to endpoints such as "/npcf-smpolicycontrol/v1/sm-policies" and related management paths can reach the business logic without any valid OAuth token, allowing an attacker to retrieve or alter subscriber session‑management policies and to expose the subscriber’s SUPI. The absence of authentication directly compromises subscriber confidentiality and enables unauthorized control of core‑network functions.

This vulnerability affects the free5GC PCF component, version 4.2.1 and earlier, in the free5gc:free5gc open‑source implementation of the 5G core network. Deployments running a pre‑4.2.2 build expose SM‑policy endpoints to unauthenticated traffic.

The CVSS score of 8.2 indicates high severity. Based on the description, it is inferred that an attacker who can reach the PCF service—whether from a compromised user equipment, a malicious internal node, or an external host if the endpoint is exposed—can issue unauthenticated requests with no additional exploits or privileges. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalogue, but the combination of an authentication bypass and publicly reachable endpoints makes this a low‑effort, high‑impact flaw.