CVE-2026-63442: CWE-117: Improper Output Neutralization for Logs in opnsense core

OPNsense core versions before 26.1.11 have an improper output neutralization vulnerability (CWE-117) in the WebGUI login username field. The field accepts carriage-return and line-feed characters that survive syslog-ng processing, allowing an attacker with network access to the login page to inject forged authentication failure or acceptance events. These forged events can cause the system to add arbitrary IP addresses to the sshlockout PF table, killing their active states and blocking legitimate administrative or network addresses, or reset the attacker's brute-force counter to bypass lockout. This vulnerability is resolved in version 26.1.11.

An attacker can cause denial of service by blocking legitimate IP addresses such as administrative, DNS, gateway, or monitoring addresses via forged log entries. Additionally, the attacker can bypass password-guessing lockout protections by resetting their own brute-force counter without authentication. The vulnerability does not impact confidentiality but has high impact on integrity and availability.

Upgrade OPNsense core to version 26.1.11 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory.