CVE-2026-30079

CVE-2026-30079 is a critical authentication bypass vulnerability in OpenAirInterface V2.2.0 AMF (Access and Mobility Management Function) that exploits improper handling of out-of-sequence messages during UE registration. By sending a SecurityModeComplete message after InitialUERegistration, an attacker can trigger incorrect state transitions that cause the system to register a user equipment without proper authentication, completely bypassing security controls. The vulnerability carries a CVSS v3.1 score of 9.8 (CRITICAL) with a network-based attack vector requiring no privileges or user interaction, indicating minimal barriers to exploitation. The attack has high impact across all three security dimensions: confidentiality, integrity, and availability. The relatively low EPSS score of 0.00058 suggests limited prevalence among comparable vulnerabilities, though this should not minimize concern given the critical CVSS rating. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and carries an inactive status on threat tracking lists. No public exploit code is readily available, and community attention remains limited. However, organizations running OpenAirInterface V2.2.0 AMF should prioritize patching to prevent potential future exploitation of this severe authentication flaw.