Authentication credentials can be manipulated when the configuration parameter auth_username_chars is left empty. This allows an attacker to inject arbitrary LDAP filters into the authentication process, potentially bypassing access controls and revealing information about the LDAP directory. The weakness corresponds to CWE-90, which addresses LDAP Injection.

Open‑Xchange GmbH’s OX Dovecot Pro is the affected product. No specific vulnerable versions are listed in the advisory, so all releases that use the default or an empty auth_username_chars value are potentially impacted.

With a CVSS score of 3.7 the vulnerability is considered low severity. No public exploits are known and the EPSS score is unavailable, suggesting limited exploitation risk under current conditions. Since the vulnerability relies on a misconfiguration that allows LDAP filter injection, an attacker must have the ability to provide authentication credentials to the affected service. The CISA KEV list does not include this issue, indicating it has not yet been exploited in the wild.