What is CVE-2026-30080?

CVE-2026-30080 is a high-severity vulnerability in Openairinterface Oai-Cn5g-Amf, classified under Authentication Bypass by Capture-replay. CVSS score: 7.5/10. Published 2026-04-08.

How severe is CVE-2026-30080?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Openairinterface Oai-Cn5g-Amf

CVE-2026-30080

OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade security context can lead to the possibility of replay attack.

Published 2026-04-08 · last modified 2026-07-25.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

EPSS exploit prediction

EPSS: 0.003 (25.7th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 26th percentile — 25.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.001

Affected products

Openairinterface Oai-Cn5g-Amf — versions 2.2.0

Weakness classification (CWE)

CWE-294 — Authentication Bypass by Capture-replay

References

gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/78 (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2026-30080?: CVE-2026-30080 is a high-severity vulnerability in Openairinterface Oai-Cn5g-Amf, classified under Authentication Bypass by Capture-replay. CVSS score: 7.5/10. Published 2026-04-08.
How severe is CVE-2026-30080?: High severity. CVSS v3 base score is 7.5 out of 10.