Authentication Bypass by Capture-replay in Dovecot - CVE-2026-27855
Published: April 1, 2026 / Updated: April 1, 2026
Vulnerability identifier: #VU124731
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-27855
CWE-ID: CWE-294
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Dovecot
Affected software:
Dovecot
Dovecot
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to authentication bypass by capture-replay in OTP authentication driver when caching credentials. A remote attacker can capture and replay OTP credentials to bypass authentication.
User interaction is required to trigger the initial authentication, and auth cache must be enabled with username alteration in passdb.
How to mitigate CVE-2026-27855
Install security update from vendor's website.