CVE-2026-27855 Auth bypass in OX Dovecot Pro
Attackers can replay OTP credentials to log in as users if auth cache is enabled and usernames are altered, requiring secure connections or protocol changes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27855?
CVE-2026-27855 is a medium-severity authentication bypass vulnerability in Dovecot Dovecot, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communcations are secured, and if possible switch to OAUTH2 or SCRAM. No publicly available exploits are known.
Weakness: CWE-294
Which versions are affected by CVE-2026-27855?
It affects 2 products.
Products include Dovecot Dovecot, Open-Xchange Dovecot.
How do I fix CVE-2026-27855?
Change a configuration setting.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-27855 being exploited?
There is no known exploitation of CVE-2026-27855 in the wild and no public exploit code.
Other vulnerabilities in Dovecot Dovecot
Sources
Also known as ALPINE-CVE-2026-27855, AZL-81701, DEBIAN-CVE-2026-27855, GHSA-7923-h3mf-4442, UBUNTU-CVE-2026-27855.