Missing authentication on NEF OAM route group in free5GC (CVE-2026-44327)

free5GC's Network Exposure Function (NEF) mounts the `nnef-oam` route group without inbound OAuth2/bearer-token authorization middleware, despite advertising OAuth2 enforcement. Any network-reachable party can send unauthenticated requests to the OAM SBI route group and receive a `200 OK` response; the missing auth boundary is route-group-scoped, meaning all future OAM operations added to this group will inherit the defect by default. Affected versions: - <= v4.2.1 We recommend updating to: v4.2.2. CVSS 10.0 · our assessment: act_now Reference: https://github.com/free5gc/free5gc/security/advisories/GHSA-cmpj-2x3g-m7g3 Details: https://vuln.today/cve/CVE-2026-44327