CVE-2026-27855
Replay Attack Vulnerability in Dovecot OTP Authentication Cache
Publication date: 2026-03-27
Last updated on: 2026-04-29
Assigner: Open-Xchange
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dovecot | dovecot | to 2.4.3 (exc) |
| open-xchange | dovecot | to 2.3.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-294 | A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Dovecot OTP (One-Time Password) authentication. When the authentication cache is enabled and the username is changed in the password database (passdb), OTP credentials can be cached improperly. This allows the same OTP response to be reused, enabling an attacker who observes an OTP exchange to log in as the user by replaying the OTP.
The issue arises because the OTP credentials are cached and not properly invalidated when the username is altered, leading to a replay attack scenario.
How can this vulnerability impact me? :
An attacker who can observe an OTP exchange can reuse the captured OTP to authenticate as the legitimate user, potentially gaining unauthorized access to the user's account.
This can lead to compromised user accounts, unauthorized access to sensitive information, and potential further exploitation within the affected system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that authentication does not happen over unsecured connections.
Switch to the SCRAM protocol for authentication if possible.
Alternatively, secure communications by using OAUTH2 or SCRAM protocols.
Also, consider disabling the auth cache or avoid altering usernames in passdb to prevent OTP credentials from being cached.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to replay OTP authentication credentials under certain conditions, potentially leading to unauthorized access to user accounts.
Such unauthorized access could result in exposure or compromise of sensitive personal or health information, which may violate compliance requirements under regulations like GDPR or HIPAA.
Therefore, organizations using affected Dovecot OTP authentication should consider this vulnerability as a risk to data confidentiality and integrity, impacting compliance with these standards.
Mitigations include securing communications, switching to more secure authentication protocols like SCRAM or OAUTH2, and ensuring proper configuration to prevent OTP replay attacks.