CVE-2026-63442
Received Received - Intake

Authentication Bypass in OPNsense WebGUI Login

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-63442
EUVD
EUVD-2026-102138

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core < 26.1.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63442 is a vulnerability in OPNsense's WebGUI login system where unauthenticated attackers can inject carriage-return and line-feed characters into the username field. This allows them to forge authentication log entries that the system processes as separate events. The lockout handler then incorrectly interprets these forged entries, leading to arbitrary IP blocking or brute-force protection bypass.

Detection Guidance

Check OPNsense logs for unusual authentication events or IP blocks. Look for log entries with CRLF characters in usernames or malformed timestamps. Use commands like 'grep -i "lockout" /var/log/system.log' or 'pfctl -t sshlockout -T show' to inspect blocked IPs and log patterns.

Impact Analysis

An attacker could block critical IPs like DNS servers, management networks, or gateways by triggering false authentication failures. They could also bypass password-guessing lockouts by injecting forged successful login events, allowing unlimited brute-force attempts against SSH or WebGUI credentials.

Mitigation Strategies

Upgrade OPNsense to version 26.1.11 or later. If immediate upgrade is not possible, review and adjust syslog-ng and lockout_handler configurations to strip CRLF characters from log inputs. Monitor firewall rules for unexpected IP blocks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63442. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart