CVE-2026-63442

Prior to version 26.1.11 , OPNsense is vulnerable to a log forgery flaw due to the unauthenticated WebGUI login usernamefld accepting carriage-return and line-feed characters. These characters survive LOG_AUTH processing and are injected into the syslog-ng destination feeding the lockout_handler....

CVE-2026-63442 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding...