OPNsense core versions before 26.7.8 contain a log injection flaw that allows an unauthenticated attacker to craft WebGUI login usernames that include arbitrary IP addresses. By repeating a username such as "Invalid user <victim-ip>", the attacker causes the system to record those IPs in the lockout table, effectively blocking SSH and WebGUI access for the victim and terminating their firewall states. This vulnerability leads to a denial of service that can be leveraged to isolate a victim’s network traffic and disrupt legitimate user sessions.

The affected product is OPNsense core. Versions less than 26.7.8 are impacted; upgrades to 26.7.8 or later exclude the flaw.

The CVSS score of 6.9 indicates a moderate severity risk. The vulnerability is exploitable without authentication and requires only the ability to submit login attempts through the WebGUI, which is typically publicly reachable. Since the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, there is no known evidence of widespread exploitation, but the attack path is straightforward and can be automated.