Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119425OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

Medium 5.4

In plain English

A medium-severity authentication bypass by spoofing in core from opnsense. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 75.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.

Affected products (as reported)

Vendor	Product	Versions
opnsense	core	26.1.6 – through 26.7.7

Weakness: CWE-290 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-864r-q4j5-5mjq) vendor-advisory
Incomplete fix patch
Incomplete fix (stable/26.7) patch
https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/captiveportal/cp-background-process.py#L78 technical-description
https://abraxaslabs.tech/research/opnsense-captive-lastseen-roam third-party-advisory
https://github.com/opnsense/core product
VulnCheck Advisory: OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP third-party-advisory