CVE-2026-89070: CWE-294 Authentication bypass by capture-replay in Progress MOVEit Transfer

This vulnerability (CVE-2026-89070) in Progress MOVEit Transfer's OIDC module enables authentication bypass through capture-replay attacks. An attacker who captures a valid authentication token can replay it to gain unauthorized access. The affected versions are all releases before 2025.1.6 and from 2026.0.0 up to 2026.0.4. The vulnerability has a CVSS 3.1 score of 7.5, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to bypass authentication controls, potentially gaining unauthorized access to MOVEit Transfer systems. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild at this time.

A fix is available in versions 2025.1.6 and 2026.0.4 and later. Users should upgrade to these versions or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the vendor's official patches. Patch status is confirmed by the affected version ranges indicating fixed versions at 2025.1.6 and 2026.0.4.