CVE-2026-63442 Details

A vulnerability in OPNsense prior to version 26.1.11 allows unauthenticated remote attackers to inject carriage-return and line-feed characters into the WebGUI login username field. This injection bypasses authentication and manipulates the authentication logging process. The injected characters are processed by syslog-ng, leading to the creation of forged authentication log entries. The 'lockout_handler' daemon, which manages brute-force protection, misinterprets these forged entries as real authentication events. This exploitation can cause the targeted IP address to be added to the 'sshlockout' pf table, blocking its network traffic and disrupting services. Additionally, the vulnerability can be used to reset the brute-force attempt counter for the attacker's own IP, allowing unlimited login attempts without triggering a lockout.

Users can update to OPNsense version 26.1.11 or 26.4.1p1, both of which include the necessary fix. The update process can be initiated through the OPNsense dashboard or via the command line.