CVE-2026-44195

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword ("Accepted" or "Successful login") between normal brute-force attempts, an attacker can prevent the failure counter from ever reaching the lockout threshold. This vulnerability is fixed in 26.1.7.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/opnsense/core/security/advisories/GHSA-h3vx-4q27-rc42	Exploit Mitigation Vendor Advisory
https://gist.github.com/sopex/b9786e72e2a5d9b1bbd81ed8477c351b	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de 26.1.7, un fallo lógico en el lockout_handler de OPNsense permite a un atacante no autenticado restablecer continuamente el contador de fallos de autenticación para su dirección IP. Al interponer un nombre de usuario manipulado que contiene una palabra clave de éxito (’Accepted’ o ’Successful login’) entre intentos normales de fuerza bruta, un atacante puede evitar que el contador de fallos alcance alguna vez el umbral de bloqueo. Esta vulnerabilidad está corregida en 26.1.7.

Information

Published : 2026-05-13 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44195

Mitre link : CVE-2026-44195

CVE.ORG link : CVE-2026-44195

JSON object : View

Products Affected

opnsense

opnsense

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2026-44195", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44195", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T13:46:23.604362Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opnsense", "product": "core", "versions": [{"status": "affected", "version": "< 26.1.7"}]}]}], "published": "2026-05-13T22:16:43.820", "references": [{"url": "https://github.com/opnsense/core/security/advisories/GHSA-h3vx-4q27-rc42", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://gist.github.com/sopex/b9786e72e2a5d9b1bbd81ed8477c351b", "tags": ["Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword (\"Accepted\" or \"Successful login\") between normal brute-force attempts, an attacker can prevent the failure counter from ever reaching the lockout threshold. This vulnerability is fixed in 26.1.7."}, {"lang": "es", "value": "OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de 26.1.7, un fallo l\u00f3gico en el lockout_handler de OPNsense permite a un atacante no autenticado restablecer continuamente el contador de fallos de autenticaci\u00f3n para su direcci\u00f3n IP. Al interponer un nombre de usuario manipulado que contiene una palabra clave de \u00e9xito (\u2019Accepted\u2019 o \u2019Successful login\u2019) entre intentos normales de fuerza bruta, un atacante puede evitar que el contador de fallos alcance alguna vez el umbral de bloqueo. Esta vulnerabilidad est\u00e1 corregida en 26.1.7."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56B95741-5F9C-4FA1-A607-456BB4C29944", "versionEndExcluding": "26.1.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}