Full authentication bypass if SASL authorization username is specified

CVE-2023-27582

What is CVE-2023-27582?

Maddy is a versatile mail server that suffers from a significant authentication bypass vulnerability. In versions from 0.2.0 through 0.6.2, if the SASL authorization username is specified using the PLAIN authentication mechanism, the server accepts the specified username without validating it against the credentials. This flaw permits unauthorized access to the mail server by exploiting the SASL authorization process, effectively allowing attackers to bypass security measures. Maddy version 0.6.3 addresses this issue, and it is recommended that users upgrade to this version or later to ensure their systems are secure.

References