The vulnerability allows an attacker to capture a valid OpenID Connect authentication token and replay it to obtain authorized access without proper authentication. The effect is that the attacker can authenticate as any user for whom a legitimate token can be captured, leading to unauthorized data access, manipulation, or potential escalation to further compromise of the affected system. The weakness is an authentication bypass and is identified as CWE‑294.

Affected products are Progress MOVEit Transfer. Versions prior to 2025.1.6 and the range from 2026.0.0 up to but not including 2026.0.4 are impacted. All installations running any of these releases are at risk.

The CVSS score is 7.5, indicating a high severity level. The EPSS score is 0.00405, indicating a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote over the network, with the attacker needing to intercept or otherwise obtain a valid OIDC token. Once the token is replayed, the system accepts the request as authenticated, granting the attacker any permissions associated with the token. The impact is full integrity and confidentiality compromise of stored data and potentially the ability to execute privileged actions, depending on the account privileges of the attacker.