CVE-2026-24031 Auth bypass in OX Dovecot Pro

High 7.7 Published 27 Mar 2026 Updated 15 Jul 2026

Attackers can bypass authentication and enumerate users if administrators clear the auth_username_chars setting in Dovecot SQL authentication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-24031?

CVE-2026-24031 is a high-severity authentication bypass vulnerability in Dovecot Dovecot, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Weakness: CWE-89

Which versions are affected by CVE-2026-24031?

It affects 2 products.

Products include Dovecot Dovecot, Open-Xchange Dovecot.

How do I fix CVE-2026-24031?

Change a configuration setting.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-24031 being exploited?

There is no known exploitation of CVE-2026-24031 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Dovecot Dovecot vulnerabilities

Sources

Also known as ALPINE-CVE-2026-24031, AZL-81698, DEBIAN-CVE-2026-24031, GHSA-fx6f-5qgf-9fmx, UBUNTU-CVE-2026-24031.