Description
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open-Xchange | OX Dovecot Pro | 2.3.13 – < 2.3.22.2, 3.0.0 – < 3.0.7, 3.1.0 – < 3.1.6 | 2.3.22.2 |
| Open-Xchange | OX Dovecot CE | 2.3.13 – < 2.4.5 | 2.4.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dovecot | 1:2.4.5+dfsg1-1 | — |
| Debian 13 | dovecot | 1:2.4.1+dfsg1-6+deb13u7 | — |
| Debian 12 | dovecot | 1:2.3.19.1+dfsg1-2.1+deb12u7 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | dovecot | No fix yet | — |
| Ubuntu 24.04 LTS | dovecot | No fix yet | — |
| Ubuntu 22.04 LTS | dovecot | No fix yet | — |
| Ubuntu 20.04 LTS | dovecot | No fix yet | — |
| Ubuntu 18.04 LTS | dovecot | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | dovecot | No fix yet | — |
| Ubuntu Pro 14.04 LTS | dovecot | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | dovecot +4 | 1:2.3.21-19.el10_2.8 | RHSA-2026:79371 |
| RHEL 9 | dovecot +4 | 1:2.3.16-18.el9_8.8 | RHSA-2026:80825 |
| RHEL 8 | dovecot +4 | 1:2.3.16-16.el8_10 | RHSA-2026:76763 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | dovecot +4 | 1:2.3.21-19.el10_2.8 | ALSA-2026:79371 |
| AlmaLinux 9 | dovecot +4 | 1:2.3.16-18.el9_8.8 | ALSA-2026:80825 |
| AlmaLinux 8 | dovecot +4 | 1:2.3.16-16.el8_10 | ALSA-2026:76763 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | dovecot | 1:2.3.21-19.el10_2.8 | RLSA-2026:98587, RLSA-2026:79371 |
| Rocky Linux 10 | dovecot-devel +3 | 1:2.3.21-22.el10_3 | RLSA-2026:98587 |
| Rocky Linux 9 | dovecot | 1:2.3.16-18.el9_8.8 | RLSA-2026:98477, RLSA-2026:80825 |
| Rocky Linux 9 | dovecot-devel +3 | 1:2.3.16-21.el9_9 | RLSA-2026:98477 |
| Rocky Linux 8 | dovecot | 1:2.3.16-16.el8_10 | RLSA-2026:76763 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 15 SP6 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 15 SP5 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 15 SP4 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | dovecot24 | 2.4.4-160000.2.1 | SUSE-SU-2026:23595-1 |
| SLES for SAP 15 SP6 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES for SAP 15 SP5 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES for SAP 15 SP4 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLES 16.0 | dovecot24 | 2.4.4-160000.2.1 | SUSE-SU-2026:23595-1 |
| SLE HPC 15 SP5 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
| SLE HPC 15 SP4 | dovecot23 | 2.3.21.1-150200.76.1 | SUSE-SU-2026:4139-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dovecot24 | 2.4.5-1.1 | openSUSE-SU-2026:11629-1 |
| openSUSE Leap 16.0 | dovecot24 | 2.4.4-160000.2.1 | openSUSE-SU-2026:21720-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | dovecot | 2.4.5-r0 | — |
| Alpine v3.23 | dovecot | 2.4.5-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | dovecot +4 | 1:2.3.20-1.amzn2023.0.4 | ALAS2023-2026-3109 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | dovecot | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | dovecot +4 | 1:2.3.21-19.el10_2.8 | ELSA-2026-79371 |
| Oracle Linux 9 | dovecot +4 | 1:2.3.16-18.el9_8.8 | ELSA-2026-80825 |
| Oracle Linux 8 | dovecot +4 | 1:2.3.16-16.el8_10 | ELSA-2026-76763 |
Advisories 20
- RLSA-2026:98587 Important: dovecot security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:98477 Important: dovecot security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-3076 Dovecot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:80825 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:79371 Important: dovecot security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:76763 Important: dovecot security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:80825 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:79371 Red Hat Security Advisory: dovecot security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:76763 Red Hat Security Advisory: dovecot security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RLSA-2026:80825 Important: dovecot security update Rocky Linux Security Advisories · Oct 14, 2026
- ELSA-2026-80825 Important: dovecot security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 12, 2026
- RLSA-2026:79371 Important: dovecot security update Rocky Linux Security Advisories · Oct 10, 2026
- ELSA-2026-79371 Important: dovecot security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 8, 2026
- RLSA-2026:76763 Important: dovecot security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 7, 2026
- ELSA-2026-76763 Important: dovecot security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 6, 2026
- SUSE-SU-2026:23595-1 Security update for dovecot24 SUSE / openSUSE Security Updates · Sep 29, 2026
- ALAS2023-2026-3109 Important: dovecot security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- SUSE-SU-2026:4139-1 Security update for dovecot23 SUSE / openSUSE Security Updates · Sep 28, 2026
- openSUSE-SU-2026:21720-1 Security update for dovecot24 SUSE / openSUSE Security Updates · Sep 2, 2026
- openSUSE-SU-2026:11629-1 dovecot24-2.4.5-1.1 on GA media SUSE / openSUSE Security Updates · Aug 29, 2026