Prior to version 4.2.2 of free5GC the NEF component mounts the nnef-oam route group without any inbound OAuth2 or bearer-token authentication. Requests that omit the Authorization header are accepted and the handler returns 200 OK. The handler is currently a stub but the flaw is structural: every future OAM route added to this group inherits the missing authentication boundary by default. This creates a missing authentication (CWE-306) and missing authorization (CWE-862) weakness that allows an attacker to access the administrative interface of NEF over the Service‐Based Interface (SBI).

The affected product is free5GC version 4.2.1 and earlier. The vulnerability is limited to the NEF service’s nnef-oam route group and does not impact other components of the free5GC stack. No other vendors or products are listed as affected.

The CVSS score of 10 indicates that the vulnerability is criticial. Exploitation requires network-level reachability to the NEF over SBI but no credentials or special privileges are needed; the absence of an authentication middleware means an attacker can send unauthenticated HTTP requests directly to the OAM endpoints. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the high CVSS and the administrative nature of the affected endpoints make it a priority to mitigate.