CVE-2026-30080
OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection.
Published Apr 8, 2026 · updated Jul 25, 2026 · openairinterface oai-cn5g-amf
OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade security context can lead to the possibility of replay attack.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 8, 2026 · NIST NVD
Detected
OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade security context can lead to the possibility of replay attack.
Jul 25, 2026 · NIST NVD
Updated
OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade security context can lead to the possibility of replay attack.
Affected
- cpe openairinterface/oai-cn5g-amf2.2.0
Sources
- CVE.orgVulnerability recordCVE-2026-30080
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-30080
OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade s
nvd.nist.gov