CVE-2026-24031

CVE-2026-24031: Dovecot SQL 認証バイパス（認証バイパス＋ユーザー列挙） このリポジトリには、CVE-2026-24031 の概念実証（PoC）認証バイパスエクスプロイトが含まれています。CVE-2026-24031 は、Dovecot 2.4.0 / 3.1.0 でリグレッションとして導入された、Dovecot の SQL ベース認証における SQL インジェクションです。テストした Docker ラボ（Dovecot 2.4.0 + PostgreSQL）では、PoC は実際のパスワードを知らなくても任意のユーザーとしてログイン でき、ユーザー列挙も行えます...

Linux Distros Unpatched Vulnerability : CVE-2026-27860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If authusernamechars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions...

CVE-2026-27860

A flaw was found in Dovecot. A remote attacker could exploit this vulnerability by injecting malicious Lightweight Directory Access Protocol LDAP filters during the authentication process. This is possible if the authusernamechars configuration setting is empty. Successful exploitation could allo...

ALPINE-CVE-2026-27860

If authusernamechars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out authusernamechars, or install fixed version. No publicly available exploits are...

CVE-2026-27860

If authusernamechars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out authusernamechars, or install fixed version. No publicly available exploits are...

AZL-81716 CVE-2026-27860 affecting package dovecot 2.3.20-1

If authusernamechars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out authusernamechars, or install fixed version. No publicly available exploits are...

CVE-2026-24031

Dovecot SQL based authentication can be bypassed when authusernamechars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear authusernamechars. If this is not possible, install latest fixed version. No publicly available exploits...

CVE-2026-24031

CVE-2026-24031 describes a vulnerability in Dovecot where SQL-based authentication can be bypassed if an admin clears the auth_username_chars setting. This allows bypassing authentication for any user and enables user enumeration. The root cause is tied to the handling of auth_username_chars; whe...

CVE-2026-27860: Improper Neutralization of Special Elements used in an LDAP Query

If authusernamechars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out authusernamechars, or install fixed version. No publicly available exploits are...

Open-Xchange OX Dovecot Pro 安全漏洞

Open-Xchange OX Dovecot Pro is an email storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a security vulnerability that can lead to authentication bypass and user enumeration when the authusernamechars field is cleared...

CVE-2026-24031: Improper Neutralization of Special Elements used in an SQL Command

Dovecot SQL based authentication can be bypassed when authusernamechars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear authusernamechars. If this is not possible, install latest fixed version. No publicly available exploits...