CVE-2026-73208: Open-Xchange Dovecot OAuth2 token scope validation bypass

CVE-2026-73208 · Severity: high · CVSS 7.4 · Published 2026-08-28

Dovecot is an email and groupware server that uses OAuth2 for authentication. A flaw in token validation allows an attacker with a token meant for a different purpose to gain unauthorized access, because the system incorrectly uses the token's audience claim (intended recipient) as a substitute for the scope claim (permissions). This could allow account takeover or unauthorized email access if a token with the wrong permissions is accepted.

Technologies: Open-Xchange Dovecot Pro. Vendors: Open-Xchange.

Quick answers

Is CVE-2026-73208 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73208 being exploited in the wild.
How severe is CVE-2026-73208?
High severity, with a CVSS score of 7.4, published 28 August 2026.
Which products and versions are affected?
Open-Xchange Dovecot Pro 2.3.0 to <2.3.22.2, 3.0.0 to <3.0.7, 3.1.0 to <3.1.6.
Is there a fix for CVE-2026-73208?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-73208 attacked?
It is attacked over the network.
Am I affected by CVE-2026-73208?
Check whether you run Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in Dovecot's OAuth2 token validation logic. When an OAuth2 token response lacks a scope claim, the implementation falls back to checking the audience claim against configured required scopes—these are semantically different. The audience claim indicates the token's intended recipient (the service it was issued for), while the scope claim describes what actions the token permits. An attacker holding a token for a different purpose can authenticate if the audience value happens to match a configured scope name. This also masks identity provider misconfigurations where scopes are not issued at all. The vulnerability affects Dovecot Pro 2.3.0–2.3.22.1, 3.0.0–3.0.6, and 3.1.0–3.1.5. No public exploits are known, but the attack requires network access to Dovecot and a valid OAuth2 token from an identity provider.

Affected products

  • Open-Xchange Dovecot Pro 2.3.0 to <2.3.22.2, 3.0.0 to <3.0.7, 3.1.0 to <3.1.6

Timeline

  • 2026-08-26: disclosed
  • 2026-08-28: advisory: Public release (OXDC-ADV-2026-0003)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.