CVE-2026-30079: Openairinterface Oai-CN5G-Amf

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registration procedure. This allows authentication to be bypassed completely. If a SecurityModeComplete message is sent after InitialUERegistration, a registration reject is received followed by a registration accept! This leads the UE to be registered without proper authentication.

Affected products

• Openairinterface Oai-CN5G-Amf: version 2.2.0 only

Published 2026-04-07. Last modified 2026-06-17.