---
id: "CVE-2026-119425"
kind: "vulnerability"
aliases: ["CVE-2026-119425"]
title: "OPNsense: captive portal roaming flaw lets attackers hijack logged-in client sessions"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["captive-portal", "firewall", "infrastructure", "opnsense", "self-hosted"]
not_affected_if: ["captive-portal-not-used", "outside-version-range", "roaming-disabled"]
published_at: "2026-10-30T12:16:39+00:00"
first_seen_at: "2026-10-30T12:30:25+00:00"
updated_at: "2026-10-30T12:32:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119425", "first_seen_at": "2026-10-30T12:30:25+00:00"}]
---

# OPNsense: captive portal roaming flaw lets attackers hijack logged-in client sessions

OPNsense's captive portal roaming feature trusts unauthenticated MAC-to-IP observations, so a device can be spoofed. An attacker on the same Layer-2 network can send forged ARP replies to take over an authorized user's portal session and its traffic attribution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OPNsense version in the web UI or with `opnsense-version`
- Confirm whether the captive portal roaming feature is enabled in the portal settings

## Fix

- OPNsense core: move to a release newer than `26.7.7`; the sources do not name the fixed version

## Timeline

- 2026-10-30T12:30:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119425

## From the sources

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_