CVE-2026-89035 is a vulnerability in MikroTik Routeros
Published on October 21, 2026
MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.
Vulnerability Analysis
CVE-2026-89035 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Products Associated with CVE-2026-89035
Want to know whenever a new CVE is published for MikroTik Routeros? stack.watch will email you.
Affected Versions
MikroTik RouterOS:- Before and including 7.23.6 is affected.
- Version 7.24.0, <= 7.24.5 is affected.