CVE-2026-0971CWE-613

GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout

Medium · published April 21, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
7.2
In the wild
Unconfirmed
What it is

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00180 · 7.2th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-04-21T14:14Z
EPSS history
Timeline
  • 21 APR 14:14Z
    GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout
    cvelistv5