User Authentication Flaw in OpenXchange Dovecot Product by OpenXchange
CVE-2025-30189

7.4HIGH

Key Information:

Vendor

Open-xchange Gmbh

Status
Ox Dovecot Pro
Vendor
CVE Published:
31 October 2025

What is CVE-2025-30189?

A flawed caching mechanism in OpenXchange Dovecot affects user identity verification. When caching is enabled, misconfigured passdb/userdb drivers cache all users using the same key, leading to the potential for incorrect user credentials to be accessed during subsequent logins. This vulnerability may result in users unknowingly gaining access to another user's session data. Users are advised to either update to the fixed version or disable caching for the affected drivers to mitigate the risk of unauthorized access. No public exploits for this flaw are currently available.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

OX Dovecot Pro 0 <= 2.4.0

References

https://documentation.open-xchange.com/dovecot/security/a...
vendor-advisory

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.