This vulnerability is an LDAP injection in OPNsense's authentication mechanism. By entering LDAP filter characters into the username field of the WebGUI login page, an unauthenticated attacker can cause the gateway to perform arbitrary LDAP searches. This allows enumeration of valid LDAP usernames and, when the LDAP server is configured with an Extended Query that restricts login to a specific group, enables an attacker to bypass that restriction and authenticate as any LDAP user for whom they know the password. The weakness follows cwe.mitre.org data definitions 90.

The flaw exists in the OPNsense core platform, affecting every installation that runs a version earlier than 26.1.6. The vulnerability is tied to the LDAP authentication connector and is present as long as the default login form is used. The CPE indicates the product is opnsense:opnsense.

The CVSS score of 8.2 places this issue in the high severity range. Although the EPSS score is below 1%, indicating low estimated exploitation probability, the flaw is not listed in CISA's KEV catalog. An attacker with network access to the WebGUI can exploit the injection without authentication. Successful exploitation could lead to unauthorized enumeration of directory users and potential elevation of privileges by bypassing group restrictions. The attack path is straightforward and requires only the ability to submit a crafted username.