Stored cross‑site scripting occurs in the OpenVPN connection‑status dashboard widget and view when a client common_name containing an unescaped double quote is rendered into the data-common-name attribute. An attacker who can create such a username, while the VPN server is configured for username‑as‑common‑name with RADIUS or LDAP, can terminate the attribute and attach an event handler. When an administrator opens the dashboard or the connection‑status page the injected script runs in the administrator’s browser session. The presented payload was able to read the configuration file, call privileged APIs, reset the root password, and execute arbitrary commands as root. This demonstrates full control of the host.

All installations of OPNsense core prior to version 26.1.11 are affected. The vulnerability exists in the widget located in src/opnsense/www/js/widgets/OpenVPNClients.js and the corresponding connection‑status view. Any deployment that uses an OpenVPN server configured with username‑as‑common‑name and allows self‑registration of usernames with double quotes is vulnerable.

The CVSS score of 8 indicates a high severity flaw. The EPSS score of <1% suggests that the probability of exploitation in the wild is low, and the vulnerability is not yet listed in the CISA KEV catalog. However, exploitation is possible only when an attacker can register a malicious OpenVPN username; it requires an OpenVPN server using username‑as‑common‑name and RADIUS/LDAP authentication, and an administrator who will open the relevant page. Once triggered, the flaw provides full root‑level access to the firewall host.