Read the docs
TI-2026-83004 Aliases CVE-2026-119425GHSA-48x9-g485-9vgw

OPNsense core Captive Portal Session Takeover via Forged ARP

Priority LOW 24CWE-290Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass in the captive portal roaming feature. Unauthenticated attackers can hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations (CWE-290). An attacker on the same Layer-2 segment sends forged gratuitous ARP replies that bind the attacker's IP to a victim's MAC, gaining portal access with traffic attributed to the victim. The CNA rates it CVSS 4.0 5.3 (MEDIUM), vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opnsensecore26.1.6 – 26.7.7—No fix listedCNA
  • core Vendoropnsense Affected 26.1.6 – 26.7.7 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*——opnsense
  • cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:* Versions — — ·opnsense

Remediation

No fixed version is listed for OPNsense core 26.1.6 through 26.7.7 at the time of publication. Restrict access to the captive portal network segment so that untrusted hosts cannot send ARP traffic to it, and monitor the segment for gratuitous ARP replies that map an IP address to a MAC address already in use by an authorized client.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119425
  2. 2026-10-30 Alias added: GHSA-48x9-g485-9vgw
  3. 2026-10-30 CISA SSVC decision points changed

References

Patch 2

Advisory 2

Other 2

  • TI-2023-20247 A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense… CVSS 3.1CRITICAL 9.8
  • TI-2023-20243 Insecure permissions in the configuration directory (/conf/) of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-20240 A command injection vulnerability in the component diag_backup.php of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-11947 DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers… CVSS 3.1CRITICAL 9.8
  • TI-2026-74819 Path traversal in OPNsense GeoIP importer allows root code execution CVSS 3.1CRITICAL 9.9
  • TI-2023-20246 /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and… CVSS 3.1CRITICAL 9.6
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences