What is the CVSS score of CVE-2026-30080?

CVE-2026-30080 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-30080?

Within 24 hours: Inventory all OpenAirInterface deployments and identify systems running v2.2.0; assess network exposure by documenting which systems face unauthenticated external access. Within 7 days: Implement network segmentation to restrict UE registration traffic to trusted sources only; disable IA0-only capability acceptance and enforce NIA1/NIA2 minimum requirements at configuration layer if available in your deployment. Within 30 days: Contact OpenAirInterface vendor for patch timeline; evaluate migration to alternative 5G core implementations if patch availability is prolonged, or deploy compensating controls including mandatory mutual TLS authentication for all UE registration endpoints.

CVE-2026-30080

EUVD-2026-20503 HIGH

Authentication Bypass by Capture-replay (CWE-294)

2026-04-08 mitre

GHSA-ppqh-5vmg-4xr4

Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 16:31 euvd

EUVD-2026-20503

Analysis Generated

Apr 08, 2026 - 16:31 vuln.today

CVE Published

Apr 08, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade security context can lead to the possibility of replay attack.

AnalysisAI

Integrity protection bypass in OpenAirInterface v2.2.0 allows unauthenticated network attackers to downgrade 5G security context by forcing acceptance of IA0-only capability during initial UE registration, despite NIA1/NIA2 being configured. Exploitation enables replay attacks against mobile network infrastructure through manipulation of Security Mode Complete messages, compromising session integrity without confidentiality impact. No public exploit identified at time of analysis.

Technical ContextAI

CWE-294 capture-replay vulnerability. Core Network AMF component fails to enforce minimum integrity algorithm requirements during NAS security negotiation. Accepts UE security capability containing only null integrity algorithm (IA0), violating 3GPP mandatory integrity protection specifications even when stronger algorithms (NIA1/NIA2) are system-configured.

RemediationAI

Vendor-acknowledged issue tracked in upstream repository; released patched version not independently confirmed at time of analysis. Primary mitigation: monitor GitLab issue tracker at https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/78 for patch release, then upgrade AMF component immediately upon availability. Interim workaround: implement network-layer policy enforcement to reject UE registration attempts presenting security capability lists containing only IA0, mandating minimum NIA1 or NIA2 integrity algorithms at MME/AMF level through configuration hardening. For production 5G Core deployments, consider temporarily restricting untrusted UE connections until patch deployment completes. Consult vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-30080