EUVD-2026-67673
GHSA-hwmp-h522-jmhg
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AV:A retained for trusted-proxy adjacency requirement; C:H and I:H reflect that impersonating any user yields full mailbox read and write access, not low integrity impact.
Primary rating from Vendor (OX).
CVSS VectorVendor: OX
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user's password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
AnalysisAI
Authentication bypass in OX Dovecot Pro and CE allows any host configured as a trusted proxy to impersonate arbitrary mail users without knowing their passwords, by injecting forged fields into Dovecot's internal authentication pipeline. The flaw is conditional: both a trusted proxy must be configured and the password database must honour a field permitting password-free authentication - deployments without trusted proxies are fully unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires both of the following conditions simultaneously: (1) the attacker must control or originate requests from a host explicitly listed in Dovecot's trusted proxy network configuration (login_trusted_networks or equivalent) - deployments with no trusted proxies configured are completely unaffected; and (2) the configured passdb backend must honour a field that permits authentication without a password (such as a nopassword flag or equivalent mechanism). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 score of 4.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) appears to materially understate real-world impact: an authentication bypass that enables full impersonation of arbitrary mail users in an IMAP server would typically carry High confidentiality and integrity impacts rather than C:N/I:L, and this discrepancy should be verified directly against the vendor advisory at the referenced CSAF URL. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the non-vulnerable version of OX Dovecot Pro or CE as specified in the vendor advisory at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json - exact fix versions are not derivable from the available CPE data (wildcard ranges) and must be taken from the advisory directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ox Dovecot Pro
View allAuthentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU
ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh
SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote att
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today