CVE-2025-66719

An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access token with any arbitrary scope.

• CWE-863

• https://github.com/free5gc/free5gc/issues/736Exploit, Issue Tracking
• https://github.com/free5gc/nrf/pull/73Issue Tracking, Patch

Published

Jan 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66689A path traversal vulnerability exists in Zen MCP Server befo…6.5
• CVE-2025-6669A vulnerability was found in gooaclok819 sublinkX up to 1.8.…3.7
• CVE-2025-66692A buffer over-read in the PublicKey::verify() method of Bina…7.5
• CVE-2025-66698An issue in Semantic machines v5.4.8 allows attackers to byp…8.6
• CVE-2025-6670A Cross-Site Request Forgery (CSRF) vulnerability exists in …8.8
• CVE-2025-66715A DLL hijacking vulnerability in Axtion ODISSAAS ODIS v1.8.4…6.5
• CVE-2025-66720Null pointer dereference in free5gc pcf 1.4.0 in file intern…7.5
• CVE-2025-66723inMusic Brands Engine DJ before 4.3.4 suffers from Insecure …7.5
• CVE-2025-6673The Easy restaurant menu manager plugin for WordPress is vul…6.4
• CVE-2025-66735youlai-boot V2.21.1 is vulnerable to Incorrect Access Contro…7.5
• CVE-2025-66736youlai-boot V2.21.1 is vulnerable to Incorrect Access Contro…7.1
• CVE-2025-66737Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory …4.3