Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the AccessTokenScopeCheck function within the internal/sbi/processor/access_token.go file. In the vulnerable version, when a request for an access token specified the targetNF as "NRF", the function would immediately return a successful response (nil error) without performing any validation of the scopes requested in the scope parameter. This is evident from the patch in commit f053bc98d1db02fd0921cb4450c0dba2ef45fa84, which adds the missing scope validation logic. An attacker could exploit this by setting targetNF to "NRF" and including arbitrary strings in the scope parameter, thereby obtaining an access token with unauthorized permissions. The fix involves adding a check to validate that the requested scopes are legitimate services offered by the NRF, such as "nnrf-nfm" or "nnrf-disc", and rejecting any requests that contain invalid scopes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/free5gc/nrf | go | < 1.4.1 | 1.4.1 |
