The vulnerability stems from Doveadm's use of direct string comparison for credential verification, creating a timing side‑channel that allows an attacker to infer the correct credentials. Discovery of the correct credentials enables an attacker to gain full access to the affected Dovecot service, providing both confidentiality and integrity compromise. This weakness is referenced as CWE‑208 and CWE‑287.

The affected product is OX Dovecot Pro from Open‑Xchange GmbH. No specific version information is supplied, so all installations should verify whether the vendor’s patch applies to their environment.

The CVSS base score of 7.4 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attacks would most likely exploit the doveadm HTTP service over the network; the description implies the attacker requires only access to the HTTP port. No publicly available exploits are known, but the potential for a timely exploitation exists once the port is reachable.