EIP-2026-100971

This is a vulnerability writeup describing a semi-persistent XSS and CSRF vulnerability in pfSense <= 2.0.1 during IPSec XAuth authentication. The exploit involves injecting JavaScript/HTML code as a username during authentication, which is then reflected in the IPSec logs.