CVE-2026-89035: Insufficient Session Expiration in MikroTik RouterOS

MikroTik RouterOS versions up to 7.24.5 contain a session token replay vulnerability in the WebFig interface. The vulnerability stems from the makeSessionKey function in libucrypto.so generating tokens with fixed salts that lack channel- or session-specific data. Additionally, the user service validates tokens against the login store without verifying the channel context. As a result, attackers who capture session tokens can replay them across new ECDH sessions to bypass authentication and gain persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified a related transport-layer exposure but was not fixed.

An attacker who captures a valid session token can reuse it to bypass authentication on the WebFig interface, gaining persistent administrative access to MikroTik RouterOS devices. This access persists until the token store is cleared, potentially allowing full control over the device. The vulnerability affects all users of the affected versions and poses a critical risk to device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should clear the token store regularly to invalidate stolen tokens and monitor for unauthorized access. Avoid using vulnerable versions if possible and follow any additional guidance from MikroTik once published.