free5GC’s NEF component, before version 4.2.2, exposes the nnef‑callback route group without requiring OAuth2 bearer‑token authentication. An attacker can send a request containing any arbitrary token—such as Authorization: Bearer not-a-real-token—and the callback handler will process the body and dispatch it into NEF business logic. Consequently, forged callback requests can alter real subscription state because the system fails to verify the producer NF identity. This represents an authentication bypass (CWE‑306) and an authorization failure (CWE‑862), allowing the attacker to modify user data and service agreements without proper credentials.

The vulnerability affects the free5GC open‑source 5G core network implementation, specifically the NEF module in releases prior to 4.2.2. All deployments of the free5GC NEF component running a version older than 4.2.2 are potentially exposed.

With a CVSS score of 7.3, the flaw is considered high severity. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the missing authentication boundary is a critical security gap. An attacker only needs to guess or obtain a valid NotifId and fabricate a bearer token to reach the SMF‑callback handler. Because the route group is reachable even when not declared in the runtime ServiceList, the attack path is straightforward and does not require additional exploits.