Skip to main content

OX Dovecot Pro EUVDEUVD-2026-67680

| CVE-2026-73208 HIGH
Improper Authentication (CWE-287)
2026-08-28 OX GHSA-856w-5q8f-fq73
Authentication Bypass Ox Dovecot Pro Ox Dovecot Ce Open Xchange Gmbh
7.4
CVSS 3.1 · Vendor: OX
Share

Severity by source

Vendor (OX) PRIMARY
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
7.4 HIGH

Network-accessible auth bypass; AC:H reflects dual preconditions (absent scope claim plus audience/scope name collision); PR:N because no prior authentication to Dovecot is required; no availability impact from token acceptance.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.4 HIGH
qualitative

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Patch available
Aug 28, 2026 - 13:17 EUVD
Analysis Generated
Aug 28, 2026 - 11:50 vuln.today
CVE Published
Aug 28, 2026 - 10:12 cve.org
HIGH 7.4

DescriptionCVE.org

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.

AnalysisAI

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass when the identity provider omits the scope claim from token responses. Dovecot incorrectly falls back to evaluating the audience claim as a substitute for scope, accepting any token whose audience value coincidentally matches a configured scope name - regardless of what permissions that token actually grants. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two concurrent conditions must be satisfied: (1) the OAuth2 identity provider must issue tokens that omit the scope claim - either due to IDP misconfiguration or because the grant type in use does not enforce scope issuance - and (2) the audience (aud) value in the attacker's token must match at least one scope name configured in Dovecot's OAuth2 settings. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N captures a network-exploitable authentication bypass with high attack complexity driven by two concurrent prerequisites: the IDP must omit the scope claim, and the token's audience value must coincidentally match a Dovecot-configured scope name. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary remediation is to upgrade to the non-vulnerable version of OX Dovecot Pro or OX Dovecot CE as specified in the Open-Xchange advisory at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json - exact fixed version numbers must be confirmed from that advisory, as they are not available in current intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all OX Dovecot Pro and CE instances configured with OAuth2 authentication and contact your identity provider to confirm that scope claims are included in all token responses; simultaneously enable detailed authentication and token validation logging on all affected Dovecot servers to establish a baseline for anomaly detection. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ox Dovecot Pro

View all
CVE-2026-42007 CRITICAL
9.1 Aug 28

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
CVE-2026-27851 CRITICAL
9.1 May 12

Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
CVE-2026-24031 HIGH
8.2 Mar 27

Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
CVE-2026-27860 LOW POC
3.7 Mar 27

Open-Xchange Dovecot Pro contains an LDAP filter injection vulnerability in its authentication module that allows remote
CVE-2026-42391 HIGH
7.5 Aug 28

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH
7.5 Aug 28

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
CVE-2026-27852 HIGH
7.5 Aug 28

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
CVE-2025-59032 HIGH
7.5 Mar 27

OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
CVE-2026-27858 HIGH
7.5 Mar 27

OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
CVE-2026-27857 HIGH
7.5 Mar 27

Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
CVE-2026-40018 HIGH
7.4 Aug 28

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
CVE-2026-27855 MEDIUM
6.8 Mar 27

Dovecot OTP authentication enables replay attacks when authentication cache is enabled and username alteration occurs in

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected

Share

EUVD-2026-67680 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy