CVE-2026-0971: GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortra GoAnywhere MFTto a version that resolves this vulnerability.Fixed in 7.10.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0971?
CVE-2026-0971 is classified as a high severity vulnerability due to its potential impact on session management.
How do I fix CVE-2026-0971?
To fix CVE-2026-0971, upgrade your Fortra GoAnywhere MFT software to version 7.10.0 or later.
What type of systems are affected by CVE-2026-0971?
CVE-2026-0971 affects GoAnywhere MFT deployments configured with SAML authentication prior to version 7.10.0.
What is the main issue caused by CVE-2026-0971?
The main issue caused by CVE-2026-0971 is that users are redirected to an incorrect login page after a session timeout.
Who is the vendor of the software affected by CVE-2026-0971?
The vendor of the affected software is Fortra, specifically their GoAnywhere MFT product.