403 Access Denied Error When Accessing MOVEit Transfer Using an Alternate URL After Upgrade

After upgrading MOVEit Transfer, accessing the application through a URL other than the configured Base URL may result in a 403 Access Denied error and cross-origin sign-on rejection messages. Affected alternate hosts must be explicitly added to the allowed host list.

Sep 22, 2026
Knowledge

Title

URL Name

403-access-denied-error-when-accessing-moveit-transfer-using-an-alternate-url-after-upgrade

Article Number

000305706

Environment

Product: MOVEit Transfer Version: 2025.1.5 and later versions containing the CVE-2026-15966 remediation OS: All Supported Operating Systems

Question/Problem Description

After upgrading MOVEit Transfer, users may receive a 403 Access Denied error when accessing the application through an alternate URL, server hostname, or non-primary load-balanced address rather than the configured Base URL.

This behavior can impact environments that previously used:

Alternate hostnames
Direct server access behind a load balancer
Multiple URLs pointing to the same MOVEit Transfer organization

The issue was observed after upgrading to MOVEit Transfer 2025.1.5.

Steps to Reproduce

1) Upgrade MOVEit Transfer to 2025.1.5 or later. 2) Configure a Base URL for the organization. 3) Access the site using a different hostname or URL than the configured Base URL. 4) Observe that the request is rejected with a 403 error.

Clarifying Information

Error Message

403 Access Denied Human_Main: Cross-origin signon attempt rejected.

Defect Number

Enhancement Number

Cause

Security enhancements introduced as part of the CVE-2026-15966 remediation enforce stricter hostname validation. Requests received using hostnames that are not explicitly recognized by MOVEit Transfer may be rejected as cross-origin requests.

Resolution

Add the alternate hostnames to the allowedhostsinheader database table.

Example:

INSERT INTO moveittransfer.allowedhostsinheader (InstID, Host)

VALUES

(<InstID>, 'hostname1.example.com'),

(<InstID>, 'hostname2.example.com');

Replace <InstID> with the organization's InstID and update the hostnames as appropriate for the environment. Once the alternate hosts are added, requests using those hostnames will be accepted.

Workaround

If direct access through alternate URLs is not required, access MOVEit Transfer using only the configured Base URL.

In some environments, URL Forwarding or Multi-Homing may also be considered depending on the deployment requirements.

Notes

Attempts to add alternate URLs through:

Security Policies → Remote Access → Trusted Hosts
HTTP Header security settings

did not resolve the issue in the reported case. The recommended solution was to populate the allowedhostsinheader database table.

Keyword Phrase

MOVEit Transfer 403 error, Cross-origin signon attempt rejected, alternate URL access denied, allowedhostsinheader, CVE-2026-15966, Base URL validation, hostname validation, load balancer hostname, direct server URL, HTTP Host header, 2025.1.5 upgrade issue.

Last Modified Date

9/22/2026 6:43 PM

403 Access Denied Error When Accessing MOVEit Transfer Using an Alternate URL After Upgrade

Files(0)

Was this article helpful?

Was this article helpful?

403 Access Denied Error When Accessing MOVEit Transfer Using an Alternate URL After Upgrade

Information

Related Articles