High severity · published Mar 27, 2026
CVE-2026-24031
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OD
OX Dovecot Pro · Open-Xchange GmbH
through 3.1.0; through 2.4.0 · source: vendor
DO
Dovecot · Dovecot
before 2.4.3 · source: NVD
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24031
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24031
Vendor Advisory
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-24031
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2452181
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24031.json
More from OX Dovecot Pro
9.1
CVE-2026-42007
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents…
9.1
CVE-2026-27851
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped
7.5
CVE-2026-42391
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately
7.5
CVE-2026-33605
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating
7.5
CVE-2026-27852
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage…