CVE-2026-89035: MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
RouterOS systems through version 7.24.5 are affected where the WebFig interface is reachable by an attacker who can obtain a valid session token. The issue can result in persistent administrative access.
What does an attacker need to exploit it?
An attacker needs to capture or otherwise obtain a valid WebFig session token. No existing account privileges or user interaction are required to replay that token across new ECDH sessions.
Does replaying a token remain effective after a new ECDH session is established?
Yes. The token generation and validation do not bind the token to channel-specific or session-specific context, allowing a captured token to be replayed across new ECDH sessions.
What can be done if patching is not immediately possible?
Explicitly clear the token store to revoke captured tokens. This is necessary because replayed tokens can continue to provide administrative access until the store is cleared.