CVE-2025-30189 Auth bypass in OX Dovecot Pro
Enabling cache causes userdb drivers to share cache keys, allowing attackers to impersonate other users after a cached login.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30189?
CVE-2025-30189 is a high-severity authentication bypass vulnerability in Open-Xchange GmbH OX Dovecot Pro, published on 31 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.
Weakness: CWE-1250
Which versions are affected by CVE-2025-30189?
Linux distribution packages (4)
dovecot24 SUSE:Linux Enterprise Server 16.0 | All versions | 2.4.2-160000.1.1 |
dovecot24 SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.4.2-160000.1.1 |
dovecot24 openSUSE:Leap 16.0 | All versions | 2.4.2-160000.1.1 |
dovecot24 openSUSE:Tumbleweed | All versions | 2.4.2-1.1 |
How do I fix CVE-2025-30189?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-30189 being exploited?
There is no known exploitation of CVE-2025-30189 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-30189, AZL-69833, AZL-69835, DEBIAN-CVE-2025-30189, DSA-6019-1, GHSA-396v-898v-98hg and 4 more.