---
id: "CVE-2026-89035"
kind: "vulnerability"
aliases: ["CVE-2026-89035"]
title: "MikroTik RouterOS WebFig: replayed session tokens grant persistent admin access"
severity: "critical"
cvss: 9.1
epss: 0.00274
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "RouterOS", "fixed": [], "affected": "<= 7.23.6, >= 7.24.0, <= 7.24.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "mikrotik", "routeros", "self-hosted", "webfig"]
not_affected_if: ["webfig-disabled"]
published_at: "2026-10-21T18:17:30+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89035", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:27:37+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-89035", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# MikroTik RouterOS WebFig: replayed session tokens grant persistent admin access

MikroTik RouterOS through 7.24.5 generates WebFig session tokens with fixed salts and does not bind them to the channel, so captured tokens can be replayed in new sessions. An attacker who steals a token keeps administrator access until the token store is cleared.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:RouterOS affected <= 7.23.6, >= 7.24.0, <= 7.24.5 fixed ?

## How to check

Run /system resource print on the router and compare the version to the affected ranges: 7.23.6 and earlier, or 7.24.0 through 7.24.5.
Check whether WebFig is enabled under /ip service print (www and www-ssl).

## Fix

Until patched, disable WebFig or restrict it to a management network, and clear the token store.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89035
- 2026-10-23T22:27:37+00:00 analyst — No MikroTik advisory for this CVE found (supportsec lists none). Affected ranges from VulnCheck (credit Chocapikk) and Dojo lab (reproduced on CHR 7.24.5). Dojo lab says fixed in 7.24.6 and 7.23.7, but Dojo's own advisory page says no stable fix, and I could not confirm either in MikroTik changelogs; stable is now 7.25 per upgrade.mikrotik.com. Fix version is therefore unverified. No exploitation or public exploit seen (Noroxi/EPSS 0.27%); a lab repro exists, no code link.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-89035

## Documents

- [advisory] VulnCheck: RouterOS WebFig session token replay https://www.vulncheck.com/advisories/mikrotik-routeros-webfig-session-token-replay-authentication-bypass
- [poc] MikroTik Dojo lab: CVE-2026-89035 reproduced on 7.24.5 https://mikrotikdojo.com/en/lab/cve-2026-89035-webfig-session-token-replay-routeros-lab/

## From the sources

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_