What is the CVSS score of EUVD-2026-20896?

EUVD-2026-20896 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of LDAP are affected by EUVD-2026-20896?

OPNsense firewalls prior to version 26.1.6 contain an LDAP filter injection vulnerability in the WebGUI login page that enables unauthenticated attackers to enumerate valid usernames and bypass…. A patch is available.

How to fix or mitigate EUVD-2026-20896?

Within 24 hours: Identify all OPNsense appliances in your environment and determine current version numbers; isolate WebGUI access to trusted administrative networks via network-level controls. Within 7 days: Upgrade all affected OPNsense instances to version 26.1.6 or later; verify LDAP configuration post-upgrade. Within 30 days: Audit LDAP group membership and administrative access; review authentication logs for suspicious login patterns or username enumeration attempts.

LDAP EUVD-2026-20896

| CVE-2026-34578 HIGH

LDAP Injection (CWE-90)

2026-04-09 GitHub_M

LDAP Authentication Bypass Code Injection

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:00 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.1.6

EUVD ID Assigned

Apr 09, 2026 - 15:00 euvd

EUVD-2026-20896

Analysis Generated

Apr 09, 2026 - 15:00 vuln.today

CVE Published

Apr 09, 2026 - 14:34 nvd

HIGH 8.2

DescriptionGitHub Advisory

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6.

AnalysisAI

LDAP filter injection in OPNsense firewall allows unauthenticated attackers to enumerate valid LDAP usernames and bypass group membership restrictions via the WebGUI login page. Affects OPNsense versions prior to 26.1.6. The vulnerability stems from failure to escape user-supplied input before insertion into LDAP search filters, enabling metacharacter injection. Attackers can authenticate as any LDAP user with known credentials, circumventing Extended Query group membership controls. No public exploit identified at time of analysis.

Technical ContextAI

Root cause is missing ldap_escape() call on username input (CWE-90: Improper Neutralization of Special Elements). LDAP filter metacharacters injected through username field manipulate search filter logic, allowing filter manipulation attacks. When Extended Query group restrictions are configured, injected filters can OR arbitrary conditions to bypass membership checks in authentication logic.

RemediationAI

Vendor-released patch: OPNsense 26.1.6. Upgrade immediately to patched version via WebGUI (System > Firmware > Updates) or command line using opnsense-update utility. Upstream fix implements proper input sanitization through ldap_escape() function (commit 016f66cb4620cd48183fa97843f343bb71813c6e). Organizations unable to upgrade immediately should disable LDAP authentication and switch to local authentication or alternative authentication backends until patching is completed. No effective workaround exists while LDAP authentication remains enabled. Review authentication logs for suspicious username patterns containing LDAP metacharacters (parentheses, asterisks, ampersands). Advisory: https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54