High severity7.7NVD Advisory· Published Mar 27, 2026· Updated Apr 29, 2026

CVE-2026-24031

Description

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Affected products

Dovecot (software)/Dovecot
cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*
Range: <2.4.3
Open-Xchange/Dovecot2 versions
cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*+ 1 more
- cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*range: <3.1.4
- (no CPE)
osv-coords4 versions
pkg:rpm/opensuse/dovecot24&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/dovecot24&distro=openSUSE%20Tumbleweed pkg:rpm/suse/dovecot24&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/dovecot24&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 2.4.3-160000.1.1+ 3 more
- (no CPE)range: < 2.4.3-160000.1.1
- (no CPE)range: < 2.4.3-1.1
- (no CPE)range: < 2.4.3-160000.1.1
- (no CPE)range: < 2.4.3-160000.1.1

Patches

Vulnerability mechanics

References

documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.jsonnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000