# CVE-2026-33603: Open-Xchange Dovecot SCRAM TLS channel binding spoofing

Source: https://junglewise.ai/threats/cve-2026-33603-open-xchange-dovecot-scram-tls-channel-binding-spoofing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-33603 · Severity: medium · CVSS 6.8 · Published 2026-05-12

A vulnerability in the Dovecot email server allows an attacker positioned on the same local network to intercept and eavesdrop on encrypted communications. By manipulating the authentication process, the attacker can bypass security checks that verify the identity of the server. This could lead to the exposure of sensitive user data and login credentials.

Technologies: [Dovecot](https://junglewise.ai/threats/technologies/dovecot), [Open-Xchange Dovecot CE](https://junglewise.ai/threats/technologies/dovecot-ce), [Open-Xchange Dovecot Pro](https://junglewise.ai/threats/technologies/dovecot-pro). Vendors: [Dovecot](https://junglewise.ai/threats/vendors/dovecot), [Open-Xchange](https://junglewise.ai/threats/vendors/open-xchange).

## Quick answers

**Is CVE-2026-33603 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33603 being exploited in the wild.

**How severe is CVE-2026-33603?** Medium severity, with a CVSS score of 6.8, published 12 May 2026.

**Which products and versions are affected?** Open-Xchange Dovecot CE 2.4.0, 2.4.3; Open-Xchange Dovecot Pro 2.3.0, 3.0.5, 3.1.0, 3.1.4.

**Is there a fix for CVE-2026-33603?** A patch was published on 2026-05-05: Initial internal release of fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33603 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-33603?** Check whether you run Dovecot, Open-Xchange Dovecot CE or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Dovecot's implementation of SCRAM authentication where an attacker can craft a malicious base64 exchange to spoof TLS channel binding. The flaw is categorized as improper control of resource identifiers (CWE-99). To exploit this, an attacker must be able to position themselves between the Dovecot server and the client (Man-in-the-Middle). If successful, the attacker can bypass the integrity protection provided by channel binding, allowing them to decrypt and eavesdrop on the communication session. The vulnerability is addressed in Dovecot Pro 3.1.5 and Dovecot CE 2.4.4.

## Affected products

- Open-Xchange Dovecot Pro 2.3.0, 3.0.5, 3.1.0, 3.1.4
- Open-Xchange Dovecot CE 2.4.0, 2.4.3

## Timeline

- 2026-05-05: patched: Initial internal release of fix
- 2026-05-12: disclosed: Public advisory published

## References

- [https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json](https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json)

## Related threats

- [Open-Xchange Dovecot stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-73209-open-xchange-dovecot-stack-exhaustion-denial-of-service)
- [Open-Xchange Dovecot OAuth2 token scope validation bypass](https://junglewise.ai/threats/cve-2026-73208-open-xchange-dovecot-oauth2-token-scope-validation-bypass)
- [Open-Xchange Dovecot denial of service via IMAP compression](https://junglewise.ai/threats/cve-2026-52687-open-xchange-dovecot-denial-of-service-via-imap-compression)
- [Open-Xchange Dovecot Sieve CPU resource accounting bypass](https://junglewise.ai/threats/cve-2026-52681-open-xchange-dovecot-sieve-cpu-resource-accounting-bypass)
- [Open-Xchange Dovecot denial of service via NUL byte in trusted proxy forwarding](https://junglewise.ai/threats/cve-2026-42395-open-xchange-dovecot-denial-of-service-via-nul-byte-in-trusted)