Description

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communcations are secured, and if possible switch to OAUTH2 or SCRAM. No publicly available exploits are known.

INFO

Published Date :

2026-03-27T08:10:18.821Z

Last Modified :

2026-03-27T19:39:50.286Z

Source :

OX
AFFECTED PRODUCTS

The following products are affected by CVE-2026-27855 vulnerability.

Vendors Products
Dovecot
  • Dovecot
Open-xchange
  • Dovecot
  • Ox Dovecot Pro
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-27855.

URL Resource
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-27855 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-27855 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact