CVE-2023-27582

The vulnerability CVE-2023-27582 affects maddy, a composable mail server. Versions 0.2.0 through 0.6.2 allow a full authentication bypass when SASL authorization username is provided with PLAIN authentication; the authorization username is accepted without proper validation, after credential chec...

CVE-2023-27582 Full authentication bypass if SASL authorization username is specified

maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified username, it is accepted...