5.4
MediumCVSS 3.1 · from VulnCheck
CVE-2026-119425
OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
core · CWE-290 · CWE-290Affectedcore
FixA patch is linked in the references.
PublishedOct 30, 11:30 · VulnCheck
ScoredOct 30 · 5.4 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker has to be on the same network. CVSS: adjacent network.
Description
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed incore26.1.6 – 26.7.7–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known