CVE-2025-55706: Movable Type Open Redirect Vulnerability

CVE-2025-55706 Overview

CVE-2025-55706 is an open redirect vulnerability [CWE-601] affecting Movable Type. The flaw resides in the password reset page, where an attacker can insert an invalid parameter to redirect users to an arbitrary URL. Successful exploitation requires user interaction, typically achieved through phishing links that appear to originate from a trusted Movable Type domain.

Critical Impact
Attackers can craft malicious password reset links that redirect victims from a legitimate Movable Type site to attacker-controlled destinations, enabling credential phishing and malware distribution campaigns.

Affected Products

Movable Type (versions prior to the MT-843 release)
Movable Type password reset functionality
Six Apart Movable Type publishing platform

Discovery Timeline

2025-08-20 - CVE-2025-55706 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55706

Vulnerability Analysis

The vulnerability is classified under [CWE-601] as URL Redirection to Untrusted Site, commonly known as Open Redirect. Movable Type's password reset page accepts a parameter that controls redirection behavior after processing. The application fails to validate whether the supplied URL points to a trusted destination.

Attackers exploit this weakness by supplying a crafted parameter value pointing to an external, attacker-controlled host. When a victim clicks the manipulated link, the Movable Type application processes the request and redirects the browser to the attacker's URL. The initial domain in the phishing link appears legitimate, which increases the likelihood of user interaction.

Root Cause

The root cause is insufficient validation of user-supplied URL parameters on the password reset endpoint. The application trusts input that should be constrained to an allow-list of internal paths or hostnames. Without a whitelist or origin check, any absolute URL supplied to the vulnerable parameter is honored as a redirect target.

Attack Vector

Exploitation follows a standard open redirect pattern. The attacker crafts a URL that combines the legitimate Movable Type host with a manipulated redirect parameter pointing to a malicious site. The victim receives the link through email, chat, or a compromised web page. After clicking, the browser first contacts the trusted Movable Type site, then is redirected to the attacker's destination, which often mimics the legitimate login or reset page to harvest credentials.

No authentication is required to construct the malicious URL. Refer to the JVN Security Advisory JVN76729865 for additional technical details on the vulnerable parameter.

Detection Methods for CVE-2025-55706

Indicators of Compromise

Password reset URLs containing external hostnames in redirect parameters
HTTP referer headers on external domains originating from the Movable Type password reset endpoint
Unusual spikes in traffic to the password reset page followed by 3xx redirect responses to non-local hosts
User reports of phishing emails linking to the legitimate Movable Type domain

Detection Strategies

Inspect web server access logs for password reset requests where redirect parameter values contain absolute URLs or encoded protocol schemes such as http%3A%2F%2F
Deploy web application firewall (WAF) rules that flag redirect parameters targeting hosts outside the organization's allow-list
Correlate outbound HTTP 302 responses from the Movable Type application with destination hosts to identify anomalous redirect targets

Monitoring Recommendations

Enable verbose logging on the Movable Type password reset endpoint and forward logs to a centralized SIEM
Configure alerts for repeated redirect responses to previously unseen external domains within short time windows
Monitor email gateways and user-reported phishing submissions for URLs referencing the Movable Type password reset path

How to Mitigate CVE-2025-55706

Immediate Actions Required

Upgrade Movable Type to the fixed release documented in Movable Type Release Notes MT-843
Review recent password reset activity for suspicious redirect parameter values and notify affected users
Communicate a phishing awareness reminder to administrators and content editors who receive password reset emails

Patch Information

Six Apart released the MT-843 update to remediate this vulnerability. Administrators should apply the patch by upgrading to the version referenced in the vendor advisory. Details are available in the Movable Type MT-843 release announcement and the JVN Security Advisory JVN76729865.

Workarounds

Restrict access to the Movable Type administrative interface using network-level controls or IP allow-lists until the patch is applied
Deploy WAF rules that strip or reject absolute URL values in password reset redirect parameters
Educate users to verify the destination domain after clicking password reset links and to report unexpected redirects

bash

# WAF example: block redirect parameters containing absolute URLs on the Movable Type password reset endpoint
SecRule REQUEST_URI "@contains /mt.cgi" \
  "chain,phase:2,deny,status:403,id:1055706,msg:'Blocked open redirect attempt (CVE-2025-55706)'"
  SecRule ARGS_NAMES "@rx (return|redirect|url|next)" \
    "chain"
    SecRule ARGS "@rx ^(https?:|//)" "t:lowercase,t:urlDecodeUni"