OX Dovecot Pro CVE-2026-73208

Two concurrent conditions must be satisfied: (1) the OAuth2 identity provider must issue tokens that omit the scope claim - either due to IDP misconfiguration or because the grant type in use does not enforce scope issuance - and (2) the audience (aud) value in the attacker's token must match at least one scope name configured in Dovecot's OAuth2 settings. The attacker must hold a valid token from the IDP trusted by Dovecot, but that token need not have been issued for Dovecot or email access; any token from the trusted IDP with a coincidentally matching audience value is sufficient. Exploitation is limited by: the requirement that the IDP silently omits scope claims (a non-default behavior in well-maintained modern IDPs such as Keycloak, Azure AD, and Okta, which enforce scope issuance); the specific overlap between audience values and Dovecot scope names, which is configuration-dependent; and the attacker's need to possess a valid token from the trusted IDP. Environments where the IDP consistently issues scope claims in all token responses are not exploitable regardless of audience values.

The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N captures a network-exploitable authentication bypass with high attack complexity driven by two concurrent prerequisites: the IDP must omit the scope claim, and the token's audience value must coincidentally match a Dovecot-configured scope name. The C:H/I:H impact reflects that successful authentication grants full IMAP access - reading, deleting, and manipulating email. No public exploit code exists and the vulnerability is absent from CISA KEV, so the EPSS-equivalent real-world exploitation risk is likely low in environments with correctly configured IDPs. However, the flaw is particularly dangerous in multi-tenant or legacy IDP integrations where scope issuance is inconsistently enforced, because the fallback logic also masks the IDP misconfiguration, leaving administrators unaware that tokens are being issued without scope claims. The AC:H rating appropriately constrains the exploitability estimate, but organizations should not treat this as low priority if their IDP configuration is not verified to issue scope claims consistently.

An attacker who holds a valid OAuth2 token issued by the same IDP trusted by Dovecot - for example, a token scoped for a calendar or storage API - submits it to Dovecot's IMAP authentication endpoint. If the IDP did not include a scope claim in that token and its audience value (such as 'mail-service') matches a configured Dovecot scope name, Dovecot accepts the token and grants full email access without verifying that the token was intended for or authorized against the mail service. No publicly available exploit code exists for this vulnerability.