CVE-2026-24031

Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.

Affected products

Dovecot, Linuxmint, Ubuntu

Dovecot

< 2.4.3

Open-xchange Dovecot

< 3.1.4

CVSS 3.1

8.2 HIGH

EPSS

0.4% (33th percentile)

Weakness

CWE-89

NVD status

Modified

Published

2026-03-27