CVE-2026-119425

Name of the Vulnerable Software and Affected Versions OPNsense core versions 26.1.6 through 26.7.7

Description An authentication bypass exists in the captive portal roaming feature. Unauthenticated attackers on the same Layer-2 segment can hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. This is achieved by sending forged gratuitous ARP (Address Resolution Protocol) replies—messages used to update the ARP cache of other devices—to bind the attacker's IP address to a victim's MAC address, thereby gaining portal access with traffic attributed to the victim.

Recommendations Update OPNsense core versions 26.1.6 through 26.7.7 to a newer version that contains the fix.