The vulnerability allows an attacker possessing an OAuth2 token with only part of the required scopes to authenticate successfully. Remote token validation paths accept the token despite missing scopes, while local validation path correctly enforces all scopes. This results in a bypass of the intended authorization policy, categorized as authentication bypass (CWE-287) and improper authorization (CWE-303).

The issue affects Open‑Xchange Dovecot CE and Open‑Xchange Dovecot Pro products from Open‑Xchange GmbH. Specific affected versions are not listed in the advisory, so any deployment that has not yet been patched may be vulnerable.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is 0.00179 (less than 1%), indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires possession of an OAuth2 access token that includes only a subset of the required scopes and using that token against the remote validation path, which will accept it. No publicly available exploits are known. The risk depends on the likelihood that an attacker could obtain such a partially scoped token.