CVE-2026-27855

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communcations are secured, and if possible switch to OAUTH2 or SCRAM. No publicly available exploits are known.

• CWE-294

• https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.jsonVendor Advisory

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27849Due to missing neutralization of special elements, OS comman…9.8
• CVE-2026-2785Invalid pointer in the JavaScript Engine component. This vul…9.8
• CVE-2026-27850Due to an improperly configured firewall rule, the router wi…7.5
• CVE-2026-27851When safe filter is used with variable expansion, all follow…9.1
• CVE-2026-27853An attacker might be able to trigger an out-of-bounds write …7.5
• CVE-2026-27854An attacker might be able to trigger a use-after-free by sen…7.5
• CVE-2026-27856Doveadm credentials are verified using direct comparison whi…5.9
• CVE-2026-27857Sending "NOOP (((...)))" command with 4000 parenthesis open+…7.5
• CVE-2026-27858Attacker can send a specifically crafted message before auth…7.5
• CVE-2026-27859A mail message containing excessive amount of RFC 2231 MIME …5.3
• CVE-2026-2786Use-after-free in the JavaScript Engine component. This vuln…9.8
• CVE-2026-27860If auth_username_chars is empty, it is possible to inject ar…5.3