An OTP authentication mechanism in OX Dovecot Pro allows replay attacks when authentication caching is enabled and the username is modified in the passdb. Cached OTP credentials can be reused, enabling an attacker who intercepts an OTP exchange to authenticate as the victim. The weakness permits unauthorized access to user accounts without knowing the password, effectively bypassing authentication mechanisms.

Affected systems are Open‑Xchange GmbH OX Dovecot Pro clients. No specific version range is listed; administrators should verify that their installation uses a version that supports OTP caching and passdb modifications. Any deployment employing OTP authentication with caching enabled is potentially impacted.

With a CVSS score of 6.8 the vulnerability is considered medium‑high severity. EPSS information is unavailable, and the issue is not in the KEV catalogue, but the required conditions are relatively specific. The likely attack vector involves an attacker observing an OTP challenge/response over an insecure connection, then replaying the response after the username has been altered in the back‑end. No exploits have been published yet; however, the logic of the replay attack makes it feasible for an adversary capable of collecting the OTP exchange to hijack a session.