Unauthenticated WebGUI Login Vulnerability in OPNsense Firewall

CVE-2026-63442

What is CVE-2026-63442?

OPNsense is a FreeBSD-based firewall and routing platform that exhibits a vulnerability in its WebGUI login mechanism. Before version 26.1.11, it improperly processes carriage-return and line-feed characters, allowing an unauthenticated attacker with network access to exploit this flaw. The attacker can forge authentication failure events for other IP addresses, resulting in those addresses getting locked out by the sshlockout PF table. This could effectively block legitimate administrative access, DNS, and gateway functions. Furthermore, the attacker could manipulate accepted events to reset their own brute-force attack counters, facilitating ongoing unauthorized access attempts while bypassing protective lockout measures.

References