Executive brief
Dovecot, a widely used email server, contains a security flaw in its authentication system when configured to use SQL databases. If a specific configuration setting is disabled by an administrator, attackers can bypass password requirements to log into any user account or discover valid email addresses. This could lead to unauthorized access to sensitive emails and a total compromise of user mailboxes.
Technical details
A SQL injection vulnerability (CWE-89) exists in Dovecot's SQL-based authentication backend. The flaw is triggered when the 'auth_username_chars' configuration setting is explicitly cleared by an administrator, failing to properly neutralize special characters in the username field during the authentication query. A remote, unauthenticated attacker can exploit this to bypass authentication for any user or perform user enumeration. The vulnerability affects Dovecot CE versions prior to 2.4.3 and OX Dovecot Pro versions prior to 3.1.4. Administrators are advised to ensure 'auth_username_chars' is not empty or upgrade to a fixed version.
Affected products
- Dovecot Dovecot CE up to (excluding) 2.4.3
- Open-Xchange OX Dovecot Pro up to (excluding) 3.1.4
- Red Hat Red Hat Enterprise Linux 6 affected
Timeline
- 2026-03-27: disclosed
- 2026-03-27: advisory