CVE-2026-30080

HighCVSS 7.5/10Last modified Jul 25, 2026

Description

OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and proceeds. This downgrade security context can lead to the possibility of replay attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-294

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2026
Last modified: Jul 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-300826.1Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.CVE-2026-30098.1A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (CVE-2026-30106.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Que CVE-2026-30116.4The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' a CVE-2026-301179.8scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalar_url query parameter of the Scalar Pr CVE-2026-301189.8scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar_url query parameter of the Scalar Proxy en CVE-2026-30126.8A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrie CVE-2026-301209.8remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.CVE-2026-301219.1remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.CVE-2026-30138.7Coppermine Photo Gallery in versions 1.6.09 through 1.6.27 is vulnerable to path traversal. Unauthenticated remote attacker is able to explo CVE-2026-301396.1A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows atta CVE-2026-30149.1Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Serv