Authentication Bypass in OPNsense Captive Portal Feature
CVE-2026-119425

5.3MEDIUM

Key Information:

Vendor

Opnsense

Status
Core
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119425?

An authentication bypass vulnerability exists in the captive portal roaming feature of OPNsense versions 26.1.6 to 26.7.7. This vulnerability allows unauthenticated attackers on the same Layer-2 segment to exploit the feature by sending forged gratuitous ARP replies. By binding their IP address to a victim's MAC address, attackers can hijack authorized client sessions and access resources intended for the legitimate users. This security flaw underscores the importance of implementing robust authentication measures to safeguard against session hijacking and unauthorized access.

Affected Version(s)

core 26.1.6 <= 26.7.7

References

https://github.com/opnsense/core/security/advisories/GHSA...
vendor-advisory
https://github.com/opnsense/core/commit/f46836d0c3d14e26d...
patch
https://github.com/opnsense/core/commit/32dc2a3e52eefef52...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lujiefsi
Abraxas Labs
.