CVE-2026-73208: 
Dovecot vulnerability analysis and mitigation

CVE-2026-73208 is an authentication bypass vulnerability in Open-Xchange Dovecot and OX Dovecot Pro caused by incorrect OAuth2 token validation. When an OAuth2 token response lacks a scope claim, Dovecot incorrectly substitutes the audience claim and validates it against configured required scopes — two semantically distinct concepts. This allows an attacker holding a token intended for a different purpose to authenticate to Dovecot if the token's audience value happens to match a configured scope name. Affected versions include OX Dovecot Pro 2.3.13–<2.3.22.2, 3.0.0–<3.0.7, and 3.1.0–<3.1.6, and OX Dovecot CE 2.3.13–<2.4.5. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-287 (Improper Authentication) and CWE-303 (Incorrect Implementation of Authentication Algorithm). During OAuth2 token introspection or validation, Dovecot's code path falls back to using the aud (audience) claim as a substitute for the scope claim when the latter is absent from the token response. Because the audience claim identifies the intended recipient of a token rather than its granted permissions, a token with no relevant permissions can pass scope validation if its audience value coincidentally matches a configured scope name. This flaw also masks identity provider misconfigurations where scopes are not being issued at all, making the misconfiguration invisible to administrators (Github Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated attacker — who possesses a valid OAuth2 token issued for a different service or purpose — to bypass authentication and gain unauthorized access to Dovecot mail services. This can result in high confidentiality impact (unauthorized reading of email and user data) and high integrity impact (unauthorized modification of mail data), though availability is not directly affected. The vulnerability also conceals identity provider misconfigurations, potentially leaving systems in a persistently insecure state without administrator awareness (Github Advisory).

No publicly available proof-of-concept exploits are known, and there is no evidence of in-the-wild exploitation at this time. The CVE status is listed as "Deferred" and the SSVC exploitation assessment is "none." The EPSS score is approximately 0.256% (17th percentile), indicating a low near-term exploitation probability. Attack complexity is rated High, as the attacker must already possess a valid OAuth2 token intended for a different audience and the token's audience value must coincidentally match a configured Dovecot scope name (Github Advisory, Red Hat Bugzilla).

1. Obtain a valid OAuth2 token: Acquire a legitimate OAuth2 token from the shared identity provider that is intended for a different service (e.g., a token issued for an API gateway or another application), not for Dovecot.
2. Identify scope/audience overlap: Inspect the token's aud (audience) claim (e.g., via JWT decoding tools like jwt.io or python-jwt) and compare it against known or guessable Dovecot scope configuration names on the target server.
3. Confirm missing scope claim: Verify that the token response from the identity provider does not include a scope claim, triggering Dovecot's fallback behavior.
4. Authenticate to Dovecot: Submit the token to Dovecot's OAuth2 authentication endpoint (e.g., via IMAP or other mail protocols using OAUTHBEARER or XOAUTH2 SASL mechanisms). Dovecot will validate the aud value against configured scopes and incorrectly grant access.
5. Access mail data: With authenticated access, read, modify, or exfiltrate email and user data from the Dovecot mail store (Github Advisory).

• Logs: Dovecot authentication logs (/var/log/dovecot.log or equivalent) showing successful OAuth2 logins from accounts or tokens not expected to authenticate via that method; authentication events where the token's aud claim matches a configured scope name rather than a legitimate scope value.
• Logs: Identity provider audit logs showing token issuance without a scope claim for tokens subsequently used against Dovecot.
• Network: Unexpected IMAP/POP3/LMTP connections using OAUTHBEARER or XOAUTH2 SASL mechanisms from unusual source IPs or at unusual times.
• Logs: Dovecot debug logs (if enabled) showing scope claim absent in token introspection responses, with fallback to aud claim for scope validation.

Upgrade to a patched version: OX Dovecot Pro 2.3.22.2, 3.0.7, or 3.1.6; OX Dovecot CE 2.4.5 or later. As an immediate configuration-based workaround, ensure the identity provider is configured to always issue a scope claim in all token responses used with Dovecot, and verify that configured Dovecot scope names do not overlap with any audience (aud) values used in your OAuth2 environment. Both mitigations together eliminate the fallback behavior and prevent exploitation (Github Advisory, Red Hat Bugzilla).

The vulnerability was disclosed by Open-Xchange GmbH and published to the GitHub Advisory Database and NVD on August 28, 2026. It was picked up by security aggregators including VulDB, OSV.dev (Debian and Alpine advisories), openSUSE security announcements, Red Hat, and Tenable (Nessus plugin 341537). The oss-security mailing list and Full Disclosure list also carried the disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard aggregation (Github Advisory, Red Hat Bugzilla).