{"id":"CVE-2026-0971","state":"PUBLISHED","title":"GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout","description":"An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.","publishedAt":"2026-04-21T14:14:23.423Z","updatedAt":"2026-04-21T19:26:58.470Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","source":"Fortra"},"assigner":"Fortra","products":["Fortra GoAnywhere MFT"],"affected":[{"vendor":"Fortra","product":"GoAnywhere MFT","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.10.0","versionType":"semver"}],"platforms":["Windows","MacOS","Linux"]}],"references":["https://fortra.com/security/advisories/product-security/fi-2025-013"],"weaknesses":["CWE-613"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/0xxx/CVE-2026-0971.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0971","state":"PUBLISHED","datePublished":"2026-04-21T14:14:23.423Z","dateUpdated":"2026-04-21T19:26:58.470Z","assignerShortName":"Fortra","assignerOrgId":"df4dee71-de3a-4139-9588-11b62fe6c0ff","dateReserved":"2026-01-14T22:56:32.772Z"},"containers":{"cna":{"title":"GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout","descriptions":[{"lang":"en","value":"An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page."}],"affected":[{"vendor":"Fortra","product":"GoAnywhere MFT","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.10.0","versionType":"semver"}],"platforms":["Windows","MacOS","Linux"]}],"references":[{"url":"https://fortra.com/security/advisories/product-security/fi-2025-013"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","lang":"en","description":"CWE-613 Insufficient session expiration","type":"CWE"}]}],"providerMetadata":{"shortName":"Fortra","orgId":"df4dee71-de3a-4139-9588-11b62fe6c0ff","dateUpdated":"2026-04-21T14:14:23.423Z"},"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"solutions":[{"lang":"en","value":"Update to version 7.10.0 or higher of GoAnywhere MFT","supportingMedia":[{"type":"text/html","base64":false,"value":"Update to version 7.10.0 or higher of GoAnywhere MFT"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-21T19:26:48.832583Z","id":"CVE-2026-0971","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-21T19:26:58.470Z"}}]}}}