The vulnerability allows an attacker to authenticate with Open‑Xchange Dovecot by using a token whose intended purpose differs from the configured required scopes. When an OAuth2 token does not contain a scope claim, the token’s audience claim is incorrectly used for scope validation. This misinterpretation of the audience claim enables a token that grants no meaningful permissions to be accepted, thereby granting access that should have been denied. The weakness is a classic access control failure, identified as CWE‑287, and the failure to enforce scope claim presence is also a form of CWE‑303.

Affected products include Open‑Xchange GmbH’s OX Dovecot CE and OX Dovecot Pro. No specific affected version information is provided in the advisory.

The CVSS score of 7.4 indicates a high-risk vulnerability that could lead to unauthorized access. The EPSS score of 0.00256 (<1%) suggests a very low probability of exploitation in the current environment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an attacker to possess an OAuth2 token intended for a different resource; if the identity provider fails to issue a scope claim, the misused audience claim will trigger successful authentication. No publicly available exploits are known, but the ability to gain unintended access warrants prompt remediation.