CVE-2026-27855: 
Dovecot vulnerability analysis and mitigation

CVE-2026-27855 is an authentication bypass via replay attack in Dovecot's One-Time Password (OTP) authentication mechanism. The vulnerability arises under specific conditions: when the authentication cache is enabled and the username is altered in the password database (passdb), OTP credentials can be cached such that the same OTP response remains valid for subsequent authentication attempts. It affects Dovecot versions prior to 2.4.3 (open-source) and OX Dovecot Pro versions up to and including 2.3.0. The vulnerability was published on March 27, 2026, and carries a CVSS v3.1 base score of 5.9 (Medium) per NVD, though ENISA's EUVD rates it 6.8 (OX Advisory, ENISA EUVD).

The root cause is classified as CWE-294 (Authentication Bypass by Capture-Replay). When Dovecot's auth cache is active and a passdb lookup alters the username, the OTP credential response gets stored in the cache tied to the modified username. Because OTP values are cached rather than consumed, a previously observed OTP exchange can be replayed by an attacker to authenticate as the victim user. Exploitation requires the attacker to be able to observe an OTP authentication exchange — most feasible over unencrypted connections — making the attack complexity high (network-based, no privileges required, no user interaction). The vulnerability was disclosed via the oss-security mailing list and Dovecot's official CSAF advisory (OX Advisory, oss-sec).

Successful exploitation allows an attacker who has observed a valid OTP exchange to authenticate as the targeted user, resulting in a high confidentiality impact (unauthorized access to the user's mailbox and associated data). Integrity and availability are not directly impacted by this vulnerability. The scope is limited to the affected Dovecot instance, but unauthorized mailbox access could expose sensitive communications and facilitate further attacks such as credential harvesting or account takeover (OX Advisory, ENISA EUVD).

No publicly available exploits are known for CVE-2026-27855 as of the time of disclosure, and there is no evidence of in-the-wild exploitation (OX Advisory). The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A Sploitus entry referencing a PacketStorm ID (PACKETSTORM:219559) appeared in late April 2026, though this may relate to the advisory rather than a functional exploit (Sploitus).

1. Reconnaissance: Identify Dovecot mail servers running versions prior to 2.4.3 (or OX Dovecot Pro ≤ 2.3.0) with OTP authentication enabled, using network scanning tools such as Nmap or Shodan.
2. Verify configuration: Confirm that the target Dovecot instance has auth cache enabled (auth_cache_size > 0) and that a passdb driver is configured to alter the username during lookup — both conditions must be present.
3. Intercept OTP exchange: Position on the network path between the client and server (e.g., via ARP spoofing or passive monitoring on an unencrypted connection such as plain IMAP/POP3) to capture a legitimate OTP authentication exchange, recording the username and OTP response.
4. Replay the OTP: Within the cache validity window, send an authentication request to the Dovecot server using the captured username and OTP response. Because the credential is cached rather than invalidated after first use, the server accepts the replayed OTP.
5. Gain unauthorized access: Successfully authenticate as the victim user and access their mailbox contents (OX Advisory, oss-sec).

• Network: Multiple authentication attempts using the same OTP value from different source IP addresses within a short time window; authentication traffic over unencrypted protocols (plain IMAP port 143, POP3 port 110) where OTP exchanges are visible in cleartext.
• Logs: Dovecot authentication logs (/var/log/dovecot.log or /var/log/mail.log) showing successful logins from unexpected IP addresses for a user shortly after a legitimate login; repeated successful OTP authentications for the same user without corresponding failed attempts.
• Logs: Auth cache hit entries in Dovecot debug logs for OTP credentials that should have been single-use; login events from geographically disparate locations within an implausibly short timeframe for the same account.

Upgrade Dovecot to version 2.4.3 or later (open-source), or apply the corresponding OX Dovecot Pro patch as detailed in the vendor advisory. As an immediate workaround, disable the authentication cache (auth_cache_size = 0) to prevent OTP credential caching. If authentication occurs over unencrypted connections, migrate to the SCRAM protocol, or alternatively enforce TLS/SSL for all mail protocol connections. Switching to OAuth2 or SCRAM authentication is also recommended as a longer-term mitigation (OX Advisory). Distribution-level patches have been issued for Ubuntu (USN-8136-1, USN-8136-2), Debian (DSA-6197-1, DLA-4556-1), and openSUSE (Ubuntu Advisory, Debian LTS, openSUSE).

The vulnerability was disclosed via the oss-security mailing list and Seclists Full Disclosure in March 2026, generating standard community awareness without notable controversy (oss-sec, Full Disclosure). Major Linux distributions including Ubuntu, Debian, and openSUSE responded promptly with security advisories and updated packages. Security scanner vendors Tenable (Nessus) and Qualys added detection plugins shortly after disclosure, indicating routine industry response to a medium-severity vulnerability.