CVE-2025-66719
Published: 23 January 2026
Summary
CVE-2025-66719 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Free5Gc Nrf. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-66719 affects Free5GC NRF version 1.4.0, an open-source implementation of 5G core network functions. The vulnerability resides in the access-token generation logic, specifically the AccessTokenScopeCheck() function in the file internal/sbi/processor/access_token.go. This function bypasses all scope validation when an attacker supplies a crafted targetNF value, enabling the issuance of an access token with any arbitrary scope. It is classified as CWE-863 (Incorrect Authorization) and carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. By submitting a specially crafted targetNF value during access token requests, they trick the scope validation mechanism, obtaining tokens that grant unauthorized privileges across any desired scope within the Free5GC environment.
Mitigation details are documented in the GitHub issue at https://github.com/free5gc/free5gc/issues/736, with a patch available via the pull request at https://github.com/free5gc/nrf/pull/73. Security practitioners should apply this fix to affected deployments and review access token handling in similar 5G core implementations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4231
Vulnerability details
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access…
more
token with any arbitrary scope.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploit of public-facing NRF (T1190) directly bypasses authorization to issue arbitrary-scope tokens, enabling privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of inputs such as the crafted targetNF value, directly preventing the bypass of scope validation in access token generation.
AC-3 mandates enforcement of access control policies, preventing the issuance of access tokens with arbitrary unauthorized scopes due to flawed authorization logic.
SI-2 ensures identification, reporting, correction, and verification of flaws like the AccessTokenScopeCheck() bypass, enabling application of the available patch to eliminate the vulnerability.