Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-27 | 1 | Disclosure1 |
| 2026-08-13 | 1 | PoC1 |
I have published a Proof of Concept for the security note CVE-2026-24031: Dovecot SQL authentication bypass (authentication + user enumeration) at: https://github.com/aramosf/CVE-2026-24031 discovered by whisperer@yeswehack
Post summary
A PoC demonstrating CVE‑2026‑24031, an SQL authentication bypass in Dovecot, was published on GitHub; no active exploitation or patch information is reported.
CVE-2026-24031 Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and use… https://www.cve.org/CVERecord?id=CVE-2026-24031
Post summary
CVE-2026-24031 reveals a Dovecot authentication bypass via SQL when auth_username_chars is cleared, but no PoC, exploit, or patch details are provided.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dovecot | dovecot | - | - | - |
| App | open-xchange | dovecot | - | - | - |