CVE-2026-44195 affects OPNsense core firewall and routing platform versions before 26.1.7. The vulnerability arises from a logic flaw in the lockout_handler component, which manages authentication failure counters. An attacker can craft usernames containing success keywords such as "Accepted" or "Successful login" between brute-force attempts to reset the failure counter for their IP address. This prevents the failure counter from reaching the lockout threshold, effectively allowing unlimited authentication attempts without triggering lockout. The vulnerability is categorized under CWE-307 (Improper Restriction of Excessive Authentication Attempts). The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. The vulnerability is fixed in OPNsense version 26.1.7.

An unauthenticated attacker can bypass the authentication failure lockout mechanism, enabling continuous brute-force attempts without triggering lockout. This could lead to increased risk of successful credential guessing attacks. The confidentiality impact is limited, and there is no impact on integrity or availability according to the CVSS vector. No known exploits are reported in the wild.

Upgrade OPNsense core to version 26.1.7 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 26.1.7, applying this official update is the recommended remediation. No other mitigation or temporary workaround is indicated.