Threats tagged 'ghsa-48x9-g485-9vgw'

OPNsense core versions 26.1.6 through 26.7.7 have an authentication bypass vulnerability in the captive portal roaming feature. This flaw allows unauthenticated attackers on the same Layer-2 network segment to hijack authorized client sessions by spoofing MAC-to-IP bindings via forged gratuitous ARP replies. Successful exploitation grants portal access with traffic attributed to the victim.