CVE-2026-33603: Dovecot SCRAM TLS Channel Binding Bypass

CVE-2026-33603 Overview

CVE-2026-33603 is a cryptographic vulnerability in Dovecot that allows an attacker to fake Salted Challenge Response Authentication Mechanism (SCRAM) Transport Layer Security (TLS) channel binding. The flaw stems from improper handling of a specially crafted base64 exchange between Dovecot and the client. An attacker positioned between the server and client can exploit this weakness to defeat the integrity guarantees of channel binding. Successful exploitation enables the attacker to operate as a man-in-the-middle (MITM) proxy and eavesdrop on the authenticated session. The vulnerability is tracked under [CWE-99] (Improper Control of Resource Identifiers).

Critical Impact

An adjacent network attacker who intercepts the connection can bypass SCRAM channel binding protections and silently relay or eavesdrop on Dovecot client communications.

Affected Products

• Dovecot (Open-Xchange) — versions prior to the patched release listed in advisory oxdc-adv-2026-0002
• Deployments using SCRAM authentication with TLS channel binding
• Mail clients negotiating SCRAM-SHA-* mechanisms against vulnerable Dovecot servers

Discovery Timeline

• 2026-05-12 - CVE-2026-33603 published to the National Vulnerability Database (NVD)
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-33603

Vulnerability Analysis

The vulnerability resides in how Dovecot processes the base64-encoded client and server messages during SCRAM authentication. SCRAM with channel binding (the -PLUS variants) is designed to cryptographically tie the authentication exchange to the underlying TLS session. This binding prevents an MITM from relaying credentials between distinct TLS connections. Dovecot fails to correctly validate the channel binding data inside the base64 payload exchanged with the client. An attacker can craft the base64 frames in a way that causes Dovecot to accept a binding value that does not match the real TLS channel. The result is that the authentication completes successfully across two independent TLS sessions controlled by the attacker.

Root Cause

The root cause is improper parsing and validation of resource identifiers within the SCRAM message exchange, classified as [CWE-99]. Dovecot does not strictly enforce the relationship between the negotiated channel binding flag, the gs2-header, and the cryptographic material derived from the TLS session. This loose validation allows attacker-supplied data to substitute for the genuine binding value.

Attack Vector

Exploitation requires an adjacent network position between the client and the Dovecot server, raising attack complexity. The attacker terminates the client TLS connection on one side and establishes a separate TLS connection to Dovecot on the other. By manipulating the base64-encoded SCRAM frames in transit, the attacker reconciles the two sessions and convinces Dovecot that channel binding succeeded. The vulnerability does not allow direct code execution but exposes authenticated mail traffic to interception and tampering.

No public proof-of-concept code or in-the-wild exploitation has been reported. Refer to the Open-Xchange Security Advisory for protocol-level details.

Detection Methods for CVE-2026-33603

Indicators of Compromise

• Unexpected duplicate TLS sessions originating from the same client IP toward Dovecot within short time windows
• SCRAM authentication events where the negotiated mechanism is a -PLUS variant but channel binding data appears inconsistent across paired sessions
• Anomalous certificate chains presented to mail clients that do not match the Dovecot server's deployed certificate

Detection Strategies

• Inspect Dovecot authentication logs for SCRAM exchanges with abnormal base64 payload lengths or repeated gs2-header patterns
• Correlate IMAP/POP3/SMTP submission TLS handshakes with downstream session metadata to detect proxied connections
• Monitor for new or unauthorized hosts on network segments adjacent to mail infrastructure that could serve as MITM positions

Monitoring Recommendations

• Enable verbose auth_debug logging on Dovecot to capture SCRAM mechanism selection and binding outcomes
• Forward mail server authentication telemetry to a centralized analytics platform for cross-session correlation
• Alert on ARP cache changes, rogue DHCP responses, and unexpected gateway shifts on mail VLANs

How to Mitigate CVE-2026-33603

Immediate Actions Required

• Install the fixed Dovecot version published in the Open-Xchange advisory oxdc-adv-2026-0002
• Audit mail server network segments for unauthorized devices that could achieve adjacent-network positioning
• Rotate credentials for accounts that authenticated over SCRAM-PLUS during the exposure window if MITM activity is suspected

Patch Information

Open-Xchange has released a fixed version of Dovecot addressing the SCRAM channel binding validation flaw. Administrators should consult the Open-Xchange Security Advisory for the exact patched build numbers and upgrade procedures applicable to their distribution.

Workarounds

• Disable SCRAM -PLUS mechanisms and require alternative authentication paths protected by strict TLS certificate validation until patching is complete
• Enforce certificate pinning or DANE/TLSA records so mail clients reject MITM-issued certificates
• Restrict mail server reachability to trusted network segments and require VPN access for remote clients

# Configuration example: restrict SCRAM-PLUS mechanisms in dovecot.conf until patched
auth_mechanisms = plain login
ssl = required
ssl_min_protocol = TLSv1.2