CVE-2026-55784: free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress and without generating a per-session unique identifier.

An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI. Each request is accepted and overwrites the previous authentication context. A valid EAP-AKA’ response for an earlier challenge is then verified against the latest overwritten context, whose K_aut, XRES, and EapID no longer match the challenge. The result is a targeted authentication denial of service for that SUPI while the request flood is maintained.

This issue was confirmed on github.com/free5gc/ausf v1.4.4 and current main as of June 2026.