Executive brief
Dovecot is an email and groupware server that uses OAuth2 for authentication. A flaw in token validation allows an attacker with a token meant for a different purpose to gain unauthorized access, because the system incorrectly uses the token's audience claim (intended recipient) as a substitute for the scope claim (permissions). This could allow account takeover or unauthorized email access if a token with the wrong permissions is accepted.
Technical details
The vulnerability is an authentication bypass in Dovecot's OAuth2 token validation logic. When an OAuth2 token response lacks a scope claim, the implementation falls back to checking the audience claim against configured required scopes—these are semantically different. The audience claim indicates the token's intended recipient (the service it was issued for), while the scope claim describes what actions the token permits. An attacker holding a token for a different purpose can authenticate if the audience value happens to match a configured scope name. This also masks identity provider misconfigurations where scopes are not issued at all. The vulnerability affects Dovecot Pro 2.3.0–2.3.22.1, 3.0.0–3.0.6, and 3.1.0–3.1.5. No public exploits are known, but the attack requires network access to Dovecot and a valid OAuth2 token from an identity provider.
Affected products
- Open-Xchange Dovecot Pro 2.3.0 to <2.3.22.2, 3.0.0 to <3.0.7, 3.1.0 to <3.1.6
Timeline
- 2026-08-26: disclosed
- 2026-08-28: advisory: Public release (OXDC-ADV-2026-0003)