CVE-2026-119425

MEDIUM 5.4

OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.

CWE	CWE-290
Vendor	opnsense
Product	core
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for opnsense core

Be the first to know when new medium vulnerabilities affecting opnsense core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

opnsense / core

26.1.6 ≤ 26.7.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/opnsense/core/security/advisories/GHSA-864r-q4j5-5mjq github.com: https://github.com/opnsense/core/commit/f46836d0c3d14e26d79214009bfbfa9a1eecab55 github.com: https://github.com/opnsense/core/commit/32dc2a3e52eefef5251077f315a0f3243eedb834 github.com: https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/captiveportal/cp-background-process.py#L78 abraxaslabs.tech: https://abraxaslabs.tech/research/opnsense-captive-lastseen-roam github.com: https://github.com/opnsense/core vulncheck.com: https://www.vulncheck.com/advisories/opnsense-26.1.6-through-26.7.7-captive-portal-session-takeover-via-forged-arp

Credits

lujiefsi 🔍 Abraxas Labs