OX Dovecot Pro EUVD-2026-16561

Exploitation requires the server to use SQL-based authentication (a SQL passdb/userdb driver) AND an administrator to have cleared the auth_username_chars setting, which removes the username character allow-list that normally sanitizes auth input - this specific non-default configuration is the hard prerequisite without which the injection cannot trigger. When that condition is met, no attacker authentication is needed (CVSS PR:N): a remote, unauthenticated attacker reaching the login service can bypass authentication for any user and enumerate users. The main limiting factor is precisely that auth_username_chars must have been emptied; default and unmodified deployments that retain a populated auth_username_chars are not exploitable, which substantially narrows the realistically vulnerable population despite the network/unauthenticated CVSS profile.

Signals are mixed and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 8.2) indicates a network-reachable, low-complexity, unauthenticated attack, and SSVC rates Technical Impact as total, consistent with a full authentication bypass. However, several signals temper urgency: EPSS is only 0.05% (17th percentile), SSVC Exploitation is none, the CVE is NOT in CISA KEV, and no public exploit is identified at time of analysis. Critically, the published AC:L rating is arguably optimistic - exploitation is only possible when an administrator has explicitly cleared auth_username_chars, a non-default, security-weakening configuration. That precondition means the exposed population is a subset of installs rather than all of them, so realistic risk is lower than the 8.2 base score implies for typical deployments. The honest read: high impact where the vulnerable configuration exists, but gated behind a non-default setting with no evidence of in-the-wild exploitation, making this a priority patch primarily for operators who have customized auth_username_chars.

An attacker who can reach the mail server's IMAP/POP3 login interface submits a login attempt with a username containing SQL metacharacters crafted to manipulate the SQL authentication query. On a server where the administrator has cleared auth_username_chars, the injected characters are no longer filtered, letting the attacker bypass authentication into arbitrary user mailboxes or enumerate valid accounts. No public exploit is identified at time of analysis, and the attack only succeeds against the non-default configuration.