ZDF
Sign inSign up

Vulnerabilities

Security incident · GHSA-864r-q4j5-5mjq

Captive Portal roaming authorizes attacker-controlled IPs through forged ARP bindings

Published Aug 26, 2026 · catalog updated Aug 26, 2026 · Captive Portal roaming authorizes

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-864r-q4j5-5mjq. A missing EPSS score is not a low risk. Compare Captive Portal roaming authorizes with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Captive Portal roaming authorizes).
  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Medium5.4
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Not established
Affected products
See sources for product scope

## Summary OPNsense Captive Portal’s roaming feature adds every IP address observed for an authorized client’s MAC address to that client’s portal session. An unauthenticated attacker on the same Layer-2 network can send forged gratuitous ARP replies that associate the attacker’s own IP address with the MAC address of an authorized victim. During the next Captive Portal background synchronization, OPNsense adds the attacker-controlled IP to the victim’s session and to the Captive Portal PF authorization table. As a result, the attacker’s IP inherits the victim session’s portal access without independently completing the portal authorization process. The issue was confirmed on OPNsense 26.7.1_1. ## Reproduction A Captive Portal zone was configured with roaming enabled: An authorized victim session existed with: Before the attack, the Captive Portal PF table contained only the victim IP: An unauthenticated attacker sent four gratuitous ARP replies claiming: After the next Captive Portal background synchronization, the PF table contained: The table also associated with the same session ID as the victim. The forged address was obtained through the hostwatch-backed channel. The normal kernel ARP table did not contain the forged entry. ## Root cause The Captive Portal background process retrieves every IP address observed for the session’s MAC address: When roaming is enabled, those addresses are added to the existing session: The resulting address set is then added to the PF and IPFW authorization state: The problem is that ARP and hostwatch observations are not authenticated. Any adjacent host can claim that its IP belongs to another device’s MAC address. OPNsense nevertheless treats this unauthenticated claim as sufficient evidence to extend an already authorized portal session. ## Security impact An unauthenticated Layer-2-adjacent attacker can attach its own IP address to another client’s authorized Captive Portal session. This can result in: - Unauthorized portal ac

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix GHSA-864r-q4j5-5mjq

  • No stored fix

    No vendor fix text is stored. Use the linked advisory before you change production.

  • Version check

    No version range is stored, so an installed version cannot be checked on this page.

  • Advisory

    Open the inventory_github record and follow its fix.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for GHSA-864r-q4j5-5mjq. A missing EPSS score is not a low risk. Compare Captive Portal roaming authorizes with the linked advisory before you change production.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-345: Insufficient Verification of Data Authenticity; CWE-863: Incorrect Authorization. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

OPNsense security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 26, 2026 · Maintainer security tabs

    Detected

    ## Summary OPNsense Captive Portal’s roaming feature adds every IP address observed for an authorized client’s MAC address to that client’s portal session. An unauthenticated attacker on the same Layer-2 network can send forged gratuitous ARP replies that associate the attacker’s own IP address with the MAC address of an authorized victim. During the next Captive Portal background synchronization,

Sources

  • Maintainer security tabsVendor advisoryGHSA-864r-q4j5-5mjq

    ## Summary OPNsense Captive Portal’s roaming feature adds every IP address observed for an authorized client’s MAC address to that client’s portal session. An unauthenticated attacker on the same Layer-2 network can send forged gratuitous ARP replies that associate the attacker’s own IP address with the MAC address of an authorized victim. During the next Captive Portal background synchronization,

    github.com

Freshness

Last verified in this catalog Aug 26, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 2, 2026