What is the CVSS score of CVE-2026-44195?

CVE-2026-44195 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44195?

Yes, a patch is available for CVE-2026-44195. Update the affected software to the latest version immediately.

OPNsense CVE-2026-44195

EUVD-2026-30185 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-05-13 security-advisories@github.com

Information Disclosure Opnsense

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:45 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

DescriptionGitHub Advisory

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword ("Accepted" or "Successful login") between normal brute-force attempts, an attacker can prevent the failure counter from ever reaching the lockout threshold. This vulnerability is fixed in 26.1.7.

AnalysisAI

Brute-force lockout bypass in OPNsense prior to 26.1.7 allows unauthenticated remote attackers to indefinitely circumvent the authentication failure counter, enabling unlimited credential guessing against any network-accessible login endpoint. The flaw resides in the lockout_handler logic, which interprets attacker-controlled username strings containing the keywords 'Accepted' or 'Successful login' as success signals and resets the IP-based failure counter. A publicly available proof-of-concept exploit exists (SSVC exploitation: poc), the attack is classified as automatable with no prerequisites beyond network reach, and no active exploitation is confirmed in CISA KEV. EPSS is low at 0.03% (10th percentile), suggesting limited observed exploitation at time of analysis.

Technical ContextAI

OPNsense is a FreeBSD-based open-source firewall and routing platform (CPE: cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*). The root cause is CWE-307 - Improper Restriction of Excessive Authentication Attempts - specifically a logic flaw in the lockout_handler component responsible for tracking and enforcing authentication failure thresholds per source IP. The handler appears to parse log-like strings or username fields and triggers a counter reset upon detecting success-indicative keywords ('Accepted', 'Successful login'), a pattern common in log-scraping implementations that mistakenly trust attacker-supplied input as a signal of successful authentication. This design conflates attacker-controlled input with internal authentication state, allowing the attacker to continuously suppress the failure counter by interleaving crafted username strings between legitimate brute-force login attempts. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects network reachability with no authentication or complexity barriers, yielding only partial confidentiality impact because the flaw itself does not grant access - it merely removes the rate-limiting control that would otherwise prevent credential enumeration.

RemediationAI

Upgrade OPNsense core to version 26.1.7 or later, which contains the vendor-released fix as confirmed by the GitHub Security Advisory GHSA-h3vx-4q27-rc42. If immediate patching is not possible, restrict network access to the OPNsense management interface (web UI, SSH) using firewall rules that limit authentication endpoints to trusted IP ranges only - this directly eliminates the attacker's ability to reach the lockout_handler from untrusted networks, removing exploitability entirely. As an additional compensating control, enforce strong, unique administrative credentials and consider enabling multi-factor authentication if supported, which would render successful brute-force attempts ineffective even if the lockout bypass is exploited. Note that restricting the management interface is a low-risk mitigation with minimal operational trade-off, as OPNsense management interfaces should not be exposed to the public internet under standard hardening guidance.