An attacker can bypass Dovecot’s SQL‑based authentication when the configuration option auth_username_chars is cleared by an administrator. This misconfiguration allows the attacker to authenticate as any user and enumerate valid usernames, thereby compromising account integrity. The weakness is classified as CWE‑89, which involves improper handling of input leading to unauthorized access.

The vulnerability affects Open‑Xchange GmbH’s OX Dovecot Pro product. Specific version information is not provided in the CNA data, so it is assumed that all installed instances are at risk when the parameter is cleared.

The CVSS score of 7.7 indicates a high risk. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting lower current exploitation interest. The attack vector is inferred to be local or administrative, as the bypass requires an administrator to clear auth_username_chars. Because there are no publicly known exploits, the exploitation would likely involve manual reconfiguration or social engineering to change the setting, after which an attacker could authenticate as any user.