Authentication Bypass in Dovecot by Open-Xchange

CVE-2026-42008

What is CVE-2026-42008?

A vulnerability exists in Dovecot where information forwarded from a trusted proxy can be incorrectly processed, allowing malicious hosts to authenticate as any user without knowing their password. This security flaw arises when the system fails to appropriately segregate authentication fields. Environments relying on configurations that permit proxy authentication without a password could be at risk. To mitigate this vulnerability, it is crucial for users to restrict trusted proxy networks to only those that are fully controlled and to update to a secure version of Dovecot. Currently, there are no publicly available exploits for this issue.

References