Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-89035: MikroTik RouterOS WebFig allows stolen token login
CVE-2026-89035 · published 15 days ago
Summary
MikroTik RouterOS version 7.24.5 lets anyone who captures a WebFig session token reuse it to get administrator access without a password. The token is not tied to a specific connection, so an attacker can replay it in a new session and stay logged in until the token store is cleared. Update the RouterOS software to a version that fixes the token handling, and clear any existing session tokens as a precaution.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mikrotik | routeros | <= 7.23.6 |
Original advisory text
MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-613Insufficient Session Expiration
Timeline
Published21 Oct 2026
Updated3 Nov 2026
First seen21 Oct 2026
Track software like this
Free during beta