Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.
References
| Link | Resource |
|---|---|
| https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
29 Apr 2026, 19:21
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Open-xchange
Open-xchange dovecot Dovecot Dovecot dovecot |
|
| CPE | cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:* cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:* |
|
| References | () https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json - Vendor Advisory |
27 Mar 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-27 09:16
Updated : 2026-04-29 19:21
NVD link : CVE-2026-24031
Mitre link : CVE-2026-24031
CVE.ORG link : CVE-2026-24031
JSON object : View
Products Affected
open-xchange
- dovecot
dovecot
- dovecot
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')