Description
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| opnsense | core | 26.1.6 – ≤ 26.7.7 | — |
Advisories 1
- WID-SEC-2026-3032 OPNsense: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 1, 2026
References
- GitHub Security Advisory (GHSA-864r-q4j5-5mjq) vendor-advisory
- Incomplete fix patch
- Incomplete fix (stable/26.7) patch
- https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/captiveportal/cp-background-process.py#L78 technical-description
- https://abraxaslabs.tech/research/opnsense-captive-lastseen-roam third-party-advisory
- https://github.com/opnsense/core product
- VulnCheck Advisory: OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP third-party-advisory