Missing inbound authentication on nnef-pfdmanagement API in free5GC NEF (CVE-2026-44330)

free5GC's NEF mounts the `nnef-pfdmanagement` route group without any inbound OAuth2/bearer-token authorization middleware, despite advertising `OAuth2 setting receive from NRF: true`. Any network attacker able to reach NEF on the SBI can use a forged or arbitrary bearer token to read PFD application data, create attacker-controlled PFD change-notification subscriptions, and delete legitimate PFD subscriptions, affecting confidentiality, integrity, and availability of PFD management operations backed by UDR state. Affected versions: - <= v4.2.1 We recommend updating to: v4.2.2. CVSS 10.0 · our assessment: act_now Reference: https://github.com/free5gc/free5gc/security/advisories/GHSA-rwww-x45w-p52w Details: https://vuln.today/cve/CVE-2026-44330