Live › vulnerability › CVE-2026-119425
OPNsense's captive portal roaming feature trusts unauthenticated MAC-to-IP observations, so a device can be spoofed. An attacker on the same Layer-2 network can send forged ARP replies to take over an authorized user's portal session and its traffic attribution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Networks running OPNsense 26.1.6 through 26.7.7 with the captive portal in use, especially where the roaming feature is on. Attackers need to be on the same Layer-2 segment as the users, so exposure is limited to the local network. Installations without the captive portal, or on versions outside that range, can skip it.
No product ranges from the sources yet.
opnsense-version26.7.7; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
This page as .md · .json · in your agent: get_signal("CVE-2026-119425")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.