The vulnerability allows an unauthenticated attacker to inject LDAP filter metacharacters directly through the username field of the OPNsense WebGUI login page. This injection leads to LDAP enumeration of valid usernames and, if the LDAP configuration includes an Extended Query to enforce group membership, enables the attacker to authenticate as any LDAP user when that user's password is known, regardless of group restrictions. The weakness is an LDAP Injection flaw (CWE‑90) that compromises confidentiality of user identities and can compromise integrity of access controls.

OPNsense, the FreeBSD‑based firewall and routing platform, is affected in all releases prior to 26.1.6 of the core product. No later versions contain the issue. Users running older firmware should identify their current release and plan an update.

The CVSS score of 8.2 indicates a high severity. EPSS data is not available, but the vulnerability is exploitable via the publicly reachable WebGUI login page without authentication, making it readily reachable for attackers with network access. Since it is not listed in CISA’s KEV catalog, it may not yet have known active exploitation, yet the high CVSS and remotely exploitable nature warrant prompt attention.