CVE-2026-119425
mediumOPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers h…
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://abraxaslabs.tech/research/opnsense-captive-lastseen-roam disclosure@vulncheck.com
- https://github.com/opnsense/core disclosure@vulncheck.com
- https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/captiveportal/cp-backgro... disclosure@vulncheck.com
- https://github.com/opnsense/core/commit/32dc2a3e52eefef5251077f315a0f3243eedb834 disclosure@vulncheck.com
- https://github.com/opnsense/core/commit/f46836d0c3d14e26d79214009bfbfa9a1eecab55 disclosure@vulncheck.com
- https://github.com/opnsense/core/security/advisories/GHSA-864r-q4j5-5mjq disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/opnsense-26.1.6-through-26.7.7-captive-portal-session... disclosure@vulncheck.com