CVE-2025-66719

CriticalPublic PoC

Published: 23 January 2026

Published

23 January 2026

Modified

11 February 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0005 16.6th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-66719 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Free5Gc Nrf. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 requires validation of inputs such as the crafted targetNF value, directly preventing the bypass of scope validation in access token generation.

AC-3 Access Enforcement good match

prevent

AC-3 mandates enforcement of access control policies, preventing the issuance of access tokens with arbitrary unauthorized scopes due to flawed authorization logic.

SI-2 Flaw Remediation good match

prevent

SI-2 ensures identification, reporting, correction, and verification of flaws like the AccessTokenScopeCheck() bypass, enabling application of the available patch to eliminate the vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Remote unauthenticated exploit of public-facing NRF (T1190) directly bypasses authorization to issue arbitrary-scope tokens, enabling privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access…

token with any arbitrary scope.

Deeper analysisAI

CVE-2025-66719 affects Free5GC NRF version 1.4.0, an open-source implementation of 5G core network functions. The vulnerability resides in the access-token generation logic, specifically the AccessTokenScopeCheck() function in the file internal/sbi/processor/access_token.go. This function bypasses all scope validation when an attacker supplies a crafted targetNF value, enabling the issuance of an access token with any arbitrary scope. It is classified as CWE-863 (Incorrect Authorization) and carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. By submitting a specially crafted targetNF value during access token requests, they trick the scope validation mechanism, obtaining tokens that grant unauthorized privileges across any desired scope within the Free5GC environment.

Mitigation details are documented in the GitHub issue at https://github.com/free5gc/free5gc/issues/736, with a patch available via the pull request at https://github.com/free5gc/nrf/pull/73. Security practitioners should apply this fix to affected deployments and review access token handling in similar 5G core implementations.