What is CVE-2026-30080?

CVE-2026-30080 is a high-severity vulnerability in Openairinterface Oai-Cn5g-Amf, classified under Authentication Bypass by Capture-replay. CVSS score: 7.5/10. Published 2026-04-08.

How severe is CVE-2026-30080?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Openairinterface Oai-Cn5g-Amf

CVE-2026-30080

OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade security context can lead to the possibility of replay attack.

EPSS: 0.003 (16.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Openairinterface Oai-cn5g-amf — versions 2.2.0
N/a — versions n/a

Weakness classification (CWE)

CWE-294 — Authentication Bypass by Capture-replay

References

cve@mitre.org (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2026-30080?: CVE-2026-30080 is a high-severity vulnerability in Openairinterface Oai-Cn5g-Amf, classified under Authentication Bypass by Capture-replay. CVSS score: 7.5/10. Published 2026-04-08.
How severe is CVE-2026-30080?: High severity. CVSS v3 base score is 7.5 out of 10.