{"vulnerability": "cve-2026-55785", "sightings": [{"uuid": "f65b8f38-3c48-42ae-b326-27087ff2e2d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55785", "type": "seen", "source": "https://gist.github.com/alon710/80c417396f60f7c70df3dd3bd23d2e87", "content": "# CVE-2026-55785: CVE-2026-55785: Non-Constant-Time Cryptographic Comparison and Sensitive Information Leakage in free5GC AUSF\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55785\n\n## Summary\nfree5GC is an open-source implementation of the 5G core network. Prior to version 1.4.5, the Authentication Server Function (AUSF) component of free5GC performs cryptographic comparisons within its Service-Based Interface (SBI) handling logic using non-constant-time helpers. These comparison utilities return immediately upon encountering a mismatching character, creating a covert timing channel. Concurrently, the AUSF writes the expected validation vector to standard output logs at the INFO level, exposing sensitive cryptographic material to unauthorized processes or logging agents.\n\n## TL;DR\nThe free5GC AUSF component prior to version 1.4.5 leaks expected authentication secrets in plaintext console logs and verifies user authentication responses using non-constant-time operations, allowing potential credential recovery.\n\n## Technical Details\n\n- **CWE Identifier**: CWE-208: Observable Timing Discrepancy\n- **Secondary CWE**: CWE-532: Insertion of Sensitive Information into Log File\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.7\n- **Exploit Status**: none\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- free5gc AUSF\n- **ausf**: < 1.4.5 (Fixed in: `1.4.5`)\n\n## Mitigation\n\n- Upgrade the free5GC core to version 1.4.5 or newer to implement constant-time comparison wrappers.\n- Configure standard logging aggregation engines to filter out any lines containing 'XresStar' or 'res*'.\n- Limit authorization logs in production deployments of free5gc-ausf to WARN or ERROR levels.\n\n**Remediation Steps:**\n1. Navigate to the free5GC installation repository and checkout version v1.4.5 or later.\n2. Rebuild the AUSF microservice using the Go toolchain to incorporate the crypto/subtle code changes.\n3. Update your ausfcfg.yaml configurations to restrict the logging level of Auth5gAkaLog and AuthELog.\n4. Examine centralized SIEM index systems and purge any logged authentication vectors that were written prior to upgrading.\n\n## References\n\n- [GitHub Security Advisory GHSA-fp46-6vfw-gc9c](https://github.com/free5gc/free5gc/security/advisories/GHSA-fp46-6vfw-gc9c)\n- [free5gc/ausf Patch Commit](https://github.com/free5gc/ausf/commit/7a5a4aa1ec6cd0e1febebf333911c3104968edf0)\n- [free5gc/ausf Pull Request 63](https://github.com/free5gc/ausf/pull/63)\n- [free5gc/ausf Tag Release v1.4.5](https://github.com/free5gc/ausf/releases/tag/v1.4.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55785) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T08:31:54.759992Z"}]}