Security1 hOctober 16, 2026, 22:01

CVE-2026-89070: MOVEit Transfer auth bypass via replayed OIDC sessions

Progress MOVEit Transfer's OpenID Connect module contains CVE-2026-89070 (CWE-294, CVSS 7.5), an authentication bypass via capture-replay. Affected releases run from before 2025.1.6 through 2026.0.3, with fixes in 2025.1.6 and 2026.0.4. A ZoomEye query for app="MOVEit" matches 1,676 assets.

DEV Community

Open source

CVE-2026-89070: MOVEit Transfer auth bypass via replayed OIDC sessions

CVE-2026-89070 is an OIDC auth bypass in MOVEit Transfer, CVSS 7.5
Fixes shipped in versions 2025.1.6 and 2026.0.4
ZoomEye matches 1,676 assets with the app="MOVEit" fingerprint
Detection requires identifier-level logging at the identity provider

#MOVEit#Progress

watchTowr finds pre-auth RCE chain in Progress ShareFile

Security

Bitget halts withdrawals after $351.6M unauthorized transfers

Software

npm trusted publishing now manages dist-tags via OIDC

Business

CVE-2026-89070: MOVEit Transfer auth bypass via replayed OIDC sessions

watchTowr finds pre-auth RCE chain in Progress ShareFile

Bitget halts withdrawals after $351.6M unauthorized transfers

npm trusted publishing now manages dist-tags via OIDC

Qualcomm to acquire PickNik Robotics, keep MoveIt open-source