CVE-2026-73208 Open-Xchange GmbH CVE debrief

Who should care

Administrators and security teams using Dovecot with OAuth2 authentication should be aware of this vulnerability. They should assess their current configurations, verify the scope and audience claims in their tokens, and update to a non-vulnerable version if necessary.

Technical summary

The vulnerability occurs in Dovecot's OAuth2 token validation process. When a token response does not contain a scope claim, the system incorrectly uses the audience claim in its place. This can lead to a token being accepted even if it does not grant the necessary permissions, as long as its intended recipient matches a configured scope name. This not only allows unauthorized access but also masks potential misconfigurations in the identity provider where scopes are not being issued correctly.

Defensive priority

High priority due to potential for unauthorized access

Recommended defensive actions

• Ensure the identity provider issues a scope claim for all tokens used with Dovecot
• Verify that configured scope names do not match audience values
• Update to a non-vulnerable version of Dovecot
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE description indicates a vulnerability in Dovecot's OAuth2 token validation process. The issue arises when a token response lacks a scope claim, and the audience claim is used in its place. This can lead to tokens being accepted even if they grant no relevant permissions, potentially allowing unauthorized access. The CVE also notes that this vulnerability can hide identity provider misconfigurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.