OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user ' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.