The AUSF component of free5GC compared authentication values with ordinary equality functions that do not run in constant time, and it logged the expected XRES* value at info level before comparison. This disclosure of UE authentication material can be read by anyone with access to AUSF logs, and the timing characteristics of the comparison could theoretically be exploited as a side‑channel. The vulnerability is expressed by CWE‑208 (Timing Attacks), CWE‑385 (Logging Sensitive Data), and CWE‑532 (Logging of Sensitive Information).

The vulnerability exists in the free5GC open‑source 5G core network, specifically in the AUSF component’s authentication handlers in the file internal/sbi/processor/ue_authentication.go. All installations running a version prior to 1.4.5 are affected; free5GC releases 1.4.5 and newer contain the fix that performs constant‑time comparisons and removes the confidential XRES* log entry.

The CVSS score of 3.7 classifies the issue as low severity , and the EPSS score is not available, indicating no widely observed exploitation. The vulnerability does not grant remote code execution or direct access to other system resources, but it does provide attackers with sensitive authentication material that could support future cryptanalytic attacks or facilitate more targeted impersonation attempts. The risk level remains low to moderate; operators should treat the exposure as non‑critical but recommend prompt application of the fixed release.