Hello,
I have a RB2011UiAS-2HnD currently running on ROS 6.42.7. I was on an earlier version, I don't remember was it was when the behavior started.

So, I suddenly could not log in either via Winbox nor Webfig. It gave me error invalid username or password. I was pretty sure I have it correct so I thought I have gotten hacked. I reset the router and loaded from a backup from a couple of days earlier. I could log in with my username and password as normal. I then upgraded the ROS to 6.42.7 since I read there was a vulnerability with the webfig that was fixed. Everything worked fine. I changed the password just in case. Forwarding 1 day to today, it happened again. Same symptoms. However, this time, I had a winbox left opened at the login page with the "save password" ticked. I was able to log in through there. But anything new sessions of winbox or webfig would give me the invalid username or password error. Went in to change to password via the save password winbox and was able to log in as normal.

Any idea what's going on?

Thanks.

Make sure you are using the latest Winbox release (v3.17) then it should work:
https://download.mikrotik.com/routeros/ ... winbox.exe

There had been some changes within the authentication process.