Threats tagged 'ghsa-m68j-m67p-c39j'

OPNsense core versions prior to 26.7.8 have a log injection vulnerability that allows unauthenticated attackers to submit specially crafted WebGUI login usernames. This can cause victim IP addresses to be planted in the lockout_handler, resulting in the victim being blocked from SSH and WebGUI access and disruption of pf states.