The vulnerability involves mishandling the imap_auth_gss security level in Mutt prior to version 2.3.2. This mismanagement can allow an attacker to weaken authentication controls, potentially enabling unauthorized access or impersonation. The weakness is classified as CWE-843, indicating a type of data conversion or invocation error that affects security state.

Versions of Mutt older than 2.3.2 are affected. Any installation running these versions with the imap_auth_gss authentication method enabled is at risk.

The CVSS score of 3.7 reflects a low severity vulnerability. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of widespread exploitation appears limited. However, the likely attack vector is through remote IMAP authentication where an attacker could provide or manipulate credentials to trigger the mishandled security level. This could result in reduced authentication integrity or potential unauthorized access depending on the system’s configuration.