# CVE-2026-63442: OPNsense newline injection in WebGUI login lockout bypass

Source: https://junglewise.ai/threats/cve-2026-63442-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-63442 · Severity: high · CVSS 8.1 · Published 2026-10-15

OPNsense is a FreeBSD-based firewall and routing platform that protects networks by enforcing authentication and blocking brute-force attacks. An attacker with network access to the login page can inject fake login failures or successes by exploiting improper handling of line-feed characters in the login form, allowing them to lock out legitimate administrators or bypass password-guessing protections without providing credentials.

Technologies: [OPNsense](https://junglewise.ai/threats/technologies/opnsense). Vendors: [OPNsense](https://junglewise.ai/threats/vendors/opnsense).

## Quick answers

**Is CVE-2026-63442 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63442 being exploited in the wild.

**How severe is CVE-2026-63442?** High severity, with a CVSS score of 8.1, published 15 October 2026.

**Which products and versions are affected?** OPNsense Prior to 26.1.11.

**Is there a fix for CVE-2026-63442?** Yes: fixed in 26.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63442 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-63442?** Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.1.11

## Technical details

The vulnerability is a newline injection flaw in the unauthenticated WebGUI login username field that allows an attacker to inject carriage-return and line-feed characters. These characters survive syslog-ng processing and reach the lockout_handler script, where readline() treats the injected fragment as a separate authentication event. The IP parsing logic in lockout_handler incorrectly selects the first IP address instead of the last, permitting an attacker to forge lockout events for other IP addresses or reset their own brute-force counter via network access alone.

## Affected products

- OPNsense OPNsense Prior to 26.1.11

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4](https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4)
- [https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58](https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58)

## Related threats

- [OPNsense configuration line injection via GUI and API fields](https://junglewise.ai/threats/cve-2026-57154-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense cross-site scripting in web interface](https://junglewise.ai/threats/cve-2026-115425-multiple-cross-site-scripting-xss-vulnerabilities-affect)
- [OPNsense stored cross-site scripting in firewall rule and NAT tooltips](https://junglewise.ai/threats/cve-2026-58391-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense stored XSS in OpenVPN connection-status widget](https://junglewise.ai/threats/cve-2026-58390-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense Trust module XPath injection in certificate refid](https://junglewise.ai/threats/cve-2026-53582-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)