CVE-2026-119425

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

CVE-2026-119425 OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

CVE-2026-119425 OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...

CVE-2026-119425

OPNsense core versions 26.1.6 through 26.7.7 are vulnerable to an authentication bypass in the captive portal roaming feature. An unauthenticated attacker on the same Layer-2 segment can hijack authorized client sessions by sending forged gratuitous ARP replies . This allows the attacker to bind ...

PT-2026-133478

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged...