---
id: CVE-2026-119423
title: OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
summary: >-
  OPNsense core before 26.7.8 contains a log injection vulnerability that allows
  unauthenticated attackers to plant victim IP addresses in the lockout_handler
  by submitting crafted WebGUI login usernames. Attackers can submit usernames
  lik…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-117
vendor: opnsense
product: core
affected:
  - core < 26.7.8
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T15:05:24.381582Z'
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T15:05:35.901Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119423'
references:
  - url: >-
      https://github.com/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68
  - url: >-
      https://github.com/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410
  - url: >-
      https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsense/Auth/AuthenticationFactory.php#L232
  - url: >-
      https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout_handler#L70
  - url: 'https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv'
    label: GitHub Security Advisory (GHSA-2v2x-m4j7-76pv)
  - url: 'https://abraxaslabs.tech/research/opnsense-lockout-factory-ip'
  - url: 'https://github.com/opnsense/core'
  - url: >-
      https://www.vulncheck.com/advisories/opnsense-core-before-26.7.8-lockout-ip-planting-via-webgui-login-username
    label: >-
      VulnCheck Advisory: OPNsense core before 26.7.8 Lockout IP Planting via
      WebGUI Login Username
tags:
  - cve.org
epss: 0.00376
epssPercentile: 0.31724
ingestedAt: '2026-11-03T10:42:03.641Z'
---

## Overview

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.

## Affected

- `core < 26.7.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.