Executive brief
pfSense is a network firewall used to protect and control traffic on corporate and home networks. A vulnerability in the Captive Portal dashboard widget allows an attacker on a local network to inject malicious code that executes in an administrator's browser when they view the dashboard, potentially compromising their session, stealing credentials, or gaining unauthorized access to firewall configuration.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in captive_portal_status.widget.php when Captive Portal is configured with no authentication (authentication type "None"). An attacker on the local network can send a specially crafted XSS payload in the auth_user parameter; the Captive Portal accepts and stores the malicious username without validation. When an authenticated administrator views the Captive Portal widget on the dashboard, the username is rendered without HTML encoding, causing the JavaScript payload to execute in their browser session. An attacker can thus steal session cookies or hijack the administrator's session to compromise the firewall. The vulnerability is fixed in pfSense Plus 26.07+ and pfSense CE 2.9.0+; patches are available for earlier versions.
Affected products
- Netgate pfSense Plus 26.03 and earlier
- Netgate pfSense CE 2.8.1 and earlier
Timeline
- 2026-04-29: disclosed: Security advisory published (initial draft)
- 2026-04-07: patched: Fix committed to pfSense Plus master (26.07) and pfSense CE master (2.9.0)
- 2026-09-03: advisory: CVE ID CVE-2026-78849 added to advisory