CVE-2026-89070 in MOVEit Transfer
Summary
by MITRE • 10/15/2026
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical authentication bypass within the OpenID Connect (OIDC) module of Progress MOVEit Transfer, specifically affecting versions prior to 2025.1.6 and from version 2026.0.0 up to but not including 2026.0.4. This flaw stems from a capture-replay mechanism failure where the application does not adequately validate or invalidate authentication tokens after their initial issuance, allowing an attacker to intercept valid session credentials during transit and reuse them at a later time to gain unauthorized access. In standard OIDC implementations, security relies heavily on nonces, state parameters, and strict token expiration policies to prevent such replay attacks; however, the deficiency in this specific module suggests that either these values are not being checked against previous usage or the session management logic fails to enforce single-use constraints for authentication assertions.
From a technical perspective, this vulnerability aligns with CWE-294, which describes Authentication Bypass by Capture-replay, and is also closely related to CWE-384 regarding Session Fixation if the replayed token allows the attacker to hijack an existing session context. The operational impact of this flaw is severe because it effectively nullifies the authentication layer for any user account that has successfully logged in via OIDC during the vulnerable window. An adversary with network-level access, such as one positioned on a compromised segment or performing a man-in-the-middle attack against unencrypted internal traffic, can capture the OAuth2 authorization code or ID token exchange packets and replay them to authenticate as legitimate users without needing valid credentials for those accounts. This capability enables lateral movement within the organization’s infrastructure once initial foothold is established via this bypass.
The exploitation of this vulnerability does not require complex payload construction but rather precise timing and network interception capabilities, which places it firmly within the MITRE ATT&CK framework under technique T1078, specifically Valid Accounts, as well as potential indicators related to credential replay attacks often seen in advanced persistent threat campaigns. The risk is exacerbated by the fact that MOVEit Transfer is frequently used for sensitive file transfers between enterprise systems and external partners, meaning successful exploitation could lead not only to unauthorized access but also to data exfiltration or manipulation of critical business documents. Attackers can leverage this bypass to impersonate administrators or high-privilege users, thereby gaining full control over the transfer server configuration, user management features, and stored files.
Mitigation strategies must prioritize immediate patching as outlined by Progress Software in their security advisories for versions 2025.1.6 and later, including all releases from 2026.0.4 onwards. In environments where immediate patching is not feasible due to operational constraints, organizations should implement network-level controls such as mutual TLS (mTLS) between the OIDC provider and MOVEit Transfer server to prevent token interception during transit. Additionally, enforcing strict session timeouts and implementing backend validation of nonce values can help mitigate the window of opportunity for replay attacks until a permanent fix is deployed. Security teams are also advised to audit access logs for unusual patterns of authentication from single IP addresses or repeated successful logins using identical tokens, which may indicate active exploitation attempts leveraging this vulnerability.