Summary free5GC's Binding Support Function (BSF) exposes all 13 SBI management endpoints at "/nbsf-management/v1" with zero authentication middleware. Unlike every other free5GC Network Function which uses "RouterAuthorizationCheck" middleware to validate OAuth2 Bearer tokens, the BSF's "AddService()" function registers routes directly with no auth check — not even the configurable "OAuth2Required" bypass that other NFs have. Any entity with network access to the BSF SBI port can create, read, modify, and delete PCF bindings for any subscriber, enabling control-plane redirection attacks against the entire 5G core. --- ### Exposed Endpoints All 13 routes at "/nbsf-management/v1" are unauthenticated: | Method | Path | Function | Impact | | ------ | ------------------------------ | ---------------------- | ------------------------------- | | GET | "/" | Status Check | Information disclosure | | POST | "/pcfBindings" | Create PCF binding | Control-plane hijacking | | GET | "/pcfBindings" | Query PCF bindings | Subscriber data exfiltration | | GET | "/pcfBindings/:bindingId" | Get individual binding | Targeted info retrieval | | PATCH | "/pcfBindings/:bindingId" | Modify binding | Traffic redirection | | DELETE | "/pcfBindings/:bindingId" | Delete binding | Denial of service | | POST | "/pcf-ue-bindings" | Create UE binding | UE-level manipulation | | GET | "/pcf-ue-bindings" | Query UE bindings | UE enumeration | | PATCH | "/pcf-ue-bindings/:bindingId" | Modify UE binding | Per-UE hijacking | | DELETE | "/pcf-ue-bindings/:bindingId" | Delete UE binding | Session termination | | POST | "/pcf-mbs-bindings" | Create MBS binding | Multicast hijacking | | GET | "/pcf-mbs-bindings" | Query MBS bindings | Broadcast enumeration | | PATCH | "/pcf-mbs-bindings/:bindingId" | Modify MBS binding | Group traffic control | ### Root Cause Analysis #### Vulnerable Code (BSF - "NFs/bsf/internal/sbi/router.go:15-19") "go func AddService(engine *gin.Engine) { // ❌ NO AUTHENTICATION MIDDLEWARE managementGroup := engine.Group("/nbsf-management/v1") // Routes registered without any auth check managementRoutes := getManagementRoutes() applyRoutes(managementGroup, managementRoutes) } " https://github.com/aymencdm/CVE-2026-115926-free5gc-bsf-missing-auth