Dovecot SQL Authentication Bypass via Misconfigured Username Characters

CVE-2026-24031 describes an authentication bypass vulnerability affecting Dovecot, an open-source mail server. The vulnerability arises when the auth_username_chars setting, which defines the allowed characters in usernames, is cleared by an administrator. Disabling this setting allows for manipulation of SQL queries used for authentication, leading to potential bypass of authentication checks for any user and enabling user enumeration. The vulnerability was reported on March 27, 2026. There is no mention of publicly available exploits. The primary mitigation is to avoid clearing the auth_username_chars setting or to update to a patched version of Dovecot.

Attack Chain

1. An attacker identifies a Dovecot server with SQL-based authentication.
2. The attacker discovers that the auth_username_chars setting is cleared.
3. The attacker crafts a malicious username containing SQL injection code.
4. The attacker attempts to authenticate with the crafted username.
5. Dovecot processes the username in an SQL query without proper sanitization due to the missing auth_username_chars restriction.
6. The malicious SQL code is executed, bypassing authentication checks.
7. The attacker gains unauthorized access to a user's mailbox.
8. The attacker may enumerate valid usernames by manipulating the SQL injection to extract user data.

Impact

Successful exploitation of CVE-2026-24031 allows attackers to bypass authentication and gain unauthorized access to user mailboxes on affected Dovecot servers. It also enables user enumeration, which can be used in subsequent attacks. The severity of the impact depends on the sensitivity of the information stored in the compromised mailboxes. A CVSS v3.1 score of 7.7 (HIGH) indicates a significant risk.

Recommendation

• Ensure the auth_username_chars setting in Dovecot is not cleared to prevent SQL injection vulnerabilities as described in CVE-2026-24031.
• Monitor Dovecot configuration files for changes to the auth_username_chars setting using file integrity monitoring rules.
• Deploy the Sigma rule provided below to detect attempts to authenticate with usernames containing potentially malicious characters based on the expected character set defined by auth_username_chars.
• Upgrade Dovecot to the latest patched version to address this vulnerability and other potential security issues.