The vulnerability exists in the captive portal roaming feature of OPNsense, allowing unauthenticated attackers to hijack authorized client sessions. By spoofing MAC‑to‑IP observations through forged gratuitous ARP replies, an attacker on the same Layer‑2 segment can bind their own IP address to a victim’s MAC address. This results in the captive portal granting access under the victim’s identity, with all portal traffic attributed to the victim. The flaw effectively sidesteps the portal’s authentication, permitting unauthorized access to system resources and potential data exfiltration.

Affected products are OPNsense core versions 26.1.6 through 26.7.7. These releases implement the roaming feature that is impacted and have not yet included the fix. Any installation of these versions deployed on a network segment that allows ARP traffic should be considered vulnerable.

The CVSS score of 5.3 indicates a moderate risk. EPSS data is unavailable, and the issue is not listed in CISA KEV. Exploitation requires an attacker to be on the same local network segment and to send forged gratuitous ARP packets. The attack does not require privileged credentials, and thus is simple for an adversary with local network access. Because the flaw uses a standard ARP spoofing technique, defenders may mitigate by implementing ARP filtering or segmentation. Nonetheless, the absence of a patch and the moderate score suggest prompt remediation to avoid potential session hijacking.