CVE-2025-66719 Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value
Attackers can bypass scope validation in Free5gc NRF to obtain access tokens with arbitrary scopes, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66719?
CVE-2025-66719 is a critical authentication bypass vulnerability in n/a, published on 23 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access token with any arbitrary scope.
Weakness: CWE-863
Which versions are affected by CVE-2025-66719?
3 open source packages ship an affected version, including github.com/free5gc/nrf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/free5gc/nrf Go | All versions | 1.4.1 |
github.com/free5gc/nrf Go | All versions | 1.4.1 |
github.com/free5gc/nrf Go | All versions | 1.4.1 |
Products include Free5gc Nrf.
How do I fix CVE-2025-66719?
Upgrade github.com/free5gc/nrf to 1.4.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-66719 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66719 exists.
Sources
Also known as GHSA-q7c8-gfjh-8v4p, GO-2026-5570.