Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119425— OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

Quick assessment

Affected

opnsense core

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OPNsense 核心版本 26.1.6 至 26.7.7 的“受限门户漫游”（Captive Portal Roaming）功能中存在一个身份验证绕过漏洞。该漏洞允许未认证的攻击者通过伪造未认证的 MAC 地址到 IP 地址的观测记录，劫持已授权客户端的会话。位于同一二层网段的攻击者可以发送伪造的免费 ARP 响应，将自己的 IP 地址绑定到受害者的 MAC 地址，从而获得受限门户访问权限，且相关流量会被归因于受害者。

CVSS 5.4 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

Source: CVE Program / CVE List V5

Vulnerability Description

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用欺骗进行的认证绕过

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
opnsense	core	26.1.6 ~ 26.7.7	-

II. Public POCs for CVE-2026-119425

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119425

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-119425 (3)

Vendor Advisories for CVE-2026-119425 (2)

Vendor Pages for CVE-2026-119425 (1)

🔗 GitHub - opnsense/core: OPNsense GUI, API and systems backend · GitHub product

Other References for CVE-2026-119425 (1)

https://abraxaslabs.tech/research/opnsense-captive-lastseen-roam third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119425

Same Patch Batch · opnsense · 2026-10-30 · 5 CVEs total

CVE-2026-119409	7.2 HIGH	OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
CVE-2026-119424	6.8 MEDIUM	OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
CVE-2026-119560	5.9 MEDIUM	OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
CVE-2026-119423	5.3 MEDIUM	OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

IV. Related Vulnerabilities

Same product: core

Same vendor: opnsense

Same weakness: CWE-290