The vulnerability enables an attacker who can position themselves between a client and a Dovecot server to fabricate a SCRAM TLS channel binding during a base64 exchange. This misleads the server into trusting the client’s encryption context, allowing the attacker to intercept and read the encrypted traffic as a MITM proxy, thereby compromising confidentiality of all mail communications.

The flaw affects OX Dovecot Pro, developed by Open‑Xchange GmbH. No specific version constraints were listed in the advisory, so any installation that has not applied the public fix is potentially vulnerable.

The CVSS base score is 6.8, indicating moderate severity. The EPSS score is 8e-05, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be able to intercept or position themselves between the client and server—typical for an active network pass‑through or compromised router. No public exploits have been released, but the lack of a published proof of concept and the absence of a KEV listing suggest that active exploitation may be limited to targeted attacks with sufficient network positioning.