CVE-2026-73208: 
Dovecot vulnerability analysis and mitigation

CVE-2026-73208 is an authentication bypass vulnerability in Open-Xchange's Dovecot mail server caused by incorrect OAuth2 token validation. When an OAuth2 token response lacks a scope claim, Dovecot incorrectly substitutes the audience claim and validates it against configured required scopes — allowing a token intended for a different purpose to grant unauthorized access. Affected products include OX Dovecot Pro (versions 2.3.13–<2.3.22.2, 3.0.0–<3.0.7, 3.1.0–<3.1.6) and OX Dovecot CE (versions 2.3.13–<2.4.5). The vulnerability was published on August 28, 2026, with a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-287 (Improper Authentication) and CWE-303 (Incorrect Implementation of Authentication Algorithm). During OAuth2 token introspection, Dovecot fails to enforce the presence of a scope claim and silently falls back to using the audience (aud) claim as a substitute. Since audience identifies the intended recipient of a token rather than its granted permissions, a token with no relevant permissions can be accepted if its aud value coincidentally matches a configured scope name. This logic flaw also masks identity provider misconfigurations where scopes are not being issued at all. The attack requires no privileges and no user interaction, but is rated High complexity due to the precondition of possessing a valid token issued for a different service (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated attacker (holding a token intended for a different service) to bypass authentication and gain unauthorized access to Dovecot mail services. The impact includes high confidentiality risk (unauthorized reading of email and user data) and high integrity risk (potential modification of email or user data), with no direct availability impact. This could expose sensitive communications and enable further lateral movement within environments relying on Dovecot for mail delivery (GitHub Advisory).

No publicly available proof-of-concept exploit code exists, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.256% (17th percentile), indicating a low near-term exploitation probability. Exploitation requires an attacker to already possess a valid OAuth2 token issued for a different service whose audience value matches a configured Dovecot scope name, which limits opportunistic exploitation (GitHub Advisory).

1. Obtain a valid OAuth2 token: Acquire a legitimate OAuth2 token issued by the target's identity provider for a different service or resource (e.g., a token for an internal API whose aud claim matches a Dovecot-configured scope name).
2. Identify the Dovecot instance: Locate the target Dovecot mail server and confirm it uses OAuth2 authentication (e.g., via IMAP/POP3/LMTP banners or service enumeration).
3. Confirm scope/audience overlap: Determine the configured required scope names in Dovecot's OAuth2 configuration and verify that the obtained token's aud claim matches one of these scope names.
4. Authenticate to Dovecot: Submit the token to Dovecot's OAuth2 authentication endpoint (e.g., via IMAP AUTHENTICATE OAUTHBEARER or SASL XOAUTH2 mechanism) without a valid scope claim in the token response.
5. Gain unauthorized access: Dovecot accepts the token due to the fallback logic, granting access to the mail account associated with the token's identity, enabling email reading, modification, or further reconnaissance (GitHub Advisory, Red Hat Bugzilla).

• Logs: Dovecot authentication logs showing successful OAuth2 logins from unexpected clients or services; log entries where the authenticated token lacks a scope field but contains an aud value matching a configured scope name.
• Logs: Identity provider audit logs showing token issuance for one service followed immediately by Dovecot authentication events using the same token.
• Network: IMAP/POP3 connections using OAUTHBEARER or XOAUTH2 SASL mechanisms from unexpected source IPs or user agents not associated with legitimate mail clients.
• Behavioral: Mail access patterns inconsistent with normal user behavior (e.g., bulk email reads, access at unusual hours, access from unfamiliar IP addresses) following OAuth2 authentication events.

Upgrade to a patched version: OX Dovecot Pro 2.3.22.2, 3.0.7, or 3.1.6; OX Dovecot CE 2.4.5 or later. As an immediate workaround, ensure the identity provider is configured to always issue a scope claim in all OAuth2 token responses used with Dovecot. Additionally, review and reconfigure Dovecot scope names to ensure they do not overlap with any audience values used by other services, eliminating the conditions for this fallback to be exploited (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed via the Open-Xchange security advisory and reported to Red Hat's Bugzilla as a high-severity issue. It was picked up by multiple security aggregators including OSV.dev (Debian and Alpine advisories), openSUSE security announcements, Mageia advisories, and Tenable Nessus detection plugins (IDs 341537 and 342588). The oss-security mailing list and Full Disclosure list also carried notifications. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregation.