The flaw in free5GC allows concurrent authentication requests to overwrite the global AUSF context for a subscriber. By sending multiple POST /nausf-auth/v1/ue-authentications simultaneously for the same SUPI, an attacker can repeatedly replace the K_aut, XRES, and EapID values stored in the shared context. Because the authentication result is checked against the latest context, an earlier valid EAP‑AKA’ response is rejected, causing authentication failures. This results in denial of service for the affected subscriber and can be driven by a simple concurrency attack. The weakness maps to a concurrency control issue (CWE‑362).

The vulnerability exists in the free5gc open‑source 5G core network implementation, specifically in the AUSF component prior to version 1.4.4. All installations using free5gc:free5gc, version 1.4.4 or earlier, have a global sync.Map named AUSFContext.UePool that can be overwritten by concurrent requests. If your deployment relies on the unspecified default configuration of the AUSF SBI/N12 interface, it is affected.

The CVSS score of 7.5 indicates a high severity denial‑of‑service risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of an official fix means that the risk remains for all affected installations. An attacker only needs access to the AUSF SBI/N12 interface, which can be unprotected or publicly reachable in some deployments, to launch the concurrent‑request attack. The exploit is straightforward once the interface is reachable and does not require privileged host access, making it likely that systems exposed to the internet could be compromised.