CVE-2026-73208: OAuth2 Authentication Bypass Vulnerability

CVE-2026-73208 Overview

CVE-2026-73208 is an authentication bypass vulnerability in Dovecot's OAuth2 token validation logic. When an OAuth2 token response omits the scope claim, Dovecot falls back to using the audience claim and checks it against the configured required scopes. Scope and audience are distinct OAuth2 concepts, and this substitution allows a token holding no relevant permissions to be accepted when its intended recipient value matches a configured scope name. The flaw is tracked as an Improper Authentication weakness [CWE-287] and was disclosed in Open-Xchange advisory OXDC-ADV-2026-0003.

Critical Impact
An attacker holding a token issued for a different purpose can authenticate to Dovecot when the identity provider does not issue scope claims and an audience value happens to match a configured scope name.

Affected Products

Dovecot deployments using OAuth2 authentication
Environments where the identity provider omits the scope claim from token responses
Configurations where audience values overlap with configured scope names

Discovery Timeline

2026-08-28 - CVE-2026-73208 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-73208

Vulnerability Analysis

Dovecot integrates with OAuth2 identity providers to authorize mail access. During token validation, Dovecot enforces that a presented token carries one or more required scopes configured by the administrator. Scopes describe what actions a token is authorized to perform. When the OAuth2 token response includes no scope claim, Dovecot substitutes the audience claim and evaluates it against the required scope list.

The audience claim identifies the intended recipient of a token and does not describe granted permissions. Treating audience values as scopes conflates identity of the resource server with authorization to act on it. A token that grants no mail-related permissions is accepted whenever its aud value coincidentally matches a configured scope name.

The issue also masks a separate identity provider misconfiguration. Administrators may not notice that their identity provider is failing to issue scope claims at all, because authentication continues to succeed through the fallback path.

Root Cause

The root cause is an authorization-check flaw in Dovecot's OAuth2 validator. The code path that reads the scope claim falls back to audience when scope is absent, then compares that value against the required-scopes list. There is no semantic distinction between the two claim types during the check, producing an authentication bypass in the class described by [CWE-287].

Attack Vector

Exploitation requires the attacker to obtain a valid OAuth2 token from the same identity provider that Dovecot trusts. The token can be issued for any purpose, provided its aud claim value matches a scope name configured on the Dovecot server and the token response omits the scope claim.

The attacker presents this token to Dovecot's OAuth2-authenticated services such as IMAP, POP3, or SMTP submission. Dovecot validates the signature and issuer, reads the missing scope claim, substitutes audience, matches the configured scope, and grants access. The attacker gains authenticated session capabilities that the token was never intended to convey. The vulnerability is exploitable over the network without user interaction, though attack complexity is elevated by the token acquisition and configuration-match preconditions.

No publicly available exploits are known at the time of publication.

Detection Methods for CVE-2026-73208

Indicators of Compromise

Successful Dovecot OAuth2 authentication events for accounts whose tokens carry an aud value equal to a configured scope name but no scope claim.
Token introspection logs from the identity provider showing tokens issued without a scope claim being accepted by Dovecot.
Authentication activity from client identifiers or applications that were not previously authorized to access mail services.

Detection Strategies

Enable verbose Dovecot OAuth2 logging and audit token claims presented during authentication, flagging any session where the scope claim was empty or absent.
Correlate identity provider token issuance logs with Dovecot authentication logs to identify tokens whose audience does not represent a mail scope.
Baseline the set of client applications and audiences legitimately authorized to authenticate to Dovecot, and alert on new or unexpected combinations.

Monitoring Recommendations

Monitor Dovecot auth process logs for oauth2 decisions and record which claim satisfied the required-scope check.
Track identity provider configuration drift, particularly changes that remove or rename the scope claim from token responses.
Alert on authentication success from OAuth2 tokens whose audience value string-matches a Dovecot-configured scope name, as this pattern is the exploitation signature.

How to Mitigate CVE-2026-73208

Immediate Actions Required

Update Dovecot to a non-vulnerable version as described in the Open-Xchange Security Advisory OXDC-ADV-2026-0003.
Configure the identity provider to issue a scope claim for every token intended for use with Dovecot.
Rename configured scope values so they cannot collide with any audience value that the identity provider may emit.
Review recent OAuth2 authentication logs for anomalous tokens accepted through the audience-fallback path.

Patch Information

Open-Xchange has published fixed versions of Dovecot alongside advisory OXDC-ADV-2026-0003. Refer to the vendor advisory for the specific fixed release numbers applicable to your deployment channel and apply the update through your standard package management process.

Workarounds

Ensure the identity provider always includes a scope claim in token responses used against Dovecot, which prevents the vulnerable fallback path from executing.
Choose configured scope names that are guaranteed not to match any audience value issued by the identity provider, eliminating the string-collision precondition.
Restrict OAuth2 client registrations at the identity provider so that only clients authorized for mail access can obtain tokens with an audience matching Dovecot's configured scope.

bash

# Configuration example - verify Dovecot OAuth2 required scopes
# and confirm the identity provider issues scope claims.
#
# In dovecot-oauth2.conf.ext, ensure tokens_valid_scope is set to a
# value that will not appear as an aud claim from your IdP:
#
#   tokens_valid_scope = dovecot-mail-access
#
# Then verify token responses from the IdP include "scope":
#
#   curl -s -u "$CLIENT_ID:$CLIENT_SECRET" \
#        -d "grant_type=client_credentials&scope=dovecot-mail-access" \
#        https://idp.example.com/oauth2/token | jq '.scope, .aud'