{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/open-xchange/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*","cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-24031"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-ARAMOSF-CVE-2026-24031\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Dovecot (\u003c 2.4.3)","Dovecot (\u003c 3.1.4)"],"_cs_severities":["high"],"_cs_tags":["dovecot","authentication-bypass","sql-injection"],"_cs_type":"advisory","_cs_vendors":["Dovecot","Open-xchange"],"content_html":"\u003cp\u003eCVE-2026-24031 describes an authentication bypass vulnerability affecting Dovecot, an open-source mail server. The vulnerability arises when the \u003ccode\u003eauth_username_chars\u003c/code\u003e setting, which defines the allowed characters in usernames, is cleared by an administrator. Disabling this setting allows for manipulation of SQL queries used for authentication, leading to potential bypass of authentication checks for any user and enabling user enumeration. The vulnerability was reported on March 27, 2026. There is no mention of publicly available exploits. The primary mitigation is to avoid clearing the \u003ccode\u003eauth_username_chars\u003c/code\u003e setting or to update to a patched version of Dovecot.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a Dovecot server with SQL-based authentication.\u003c/li\u003e\n\u003cli\u003eThe attacker discovers that the \u003ccode\u003eauth_username_chars\u003c/code\u003e setting is cleared.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious username containing SQL injection code.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to authenticate with the crafted username.\u003c/li\u003e\n\u003cli\u003eDovecot processes the username in an SQL query without proper sanitization due to the missing \u003ccode\u003eauth_username_chars\u003c/code\u003e restriction.\u003c/li\u003e\n\u003cli\u003eThe malicious SQL code is executed, bypassing authentication checks.\u003c/li\u003e\n\u003cli\u003eThe attacker gains unauthorized access to a user's mailbox.\u003c/li\u003e\n\u003cli\u003eThe attacker may enumerate valid usernames by manipulating the SQL injection to extract user data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-24031 allows attackers to bypass authentication and gain unauthorized access to user mailboxes on affected Dovecot servers. It also enables user enumeration, which can be used in subsequent attacks. The severity of the impact depends on the sensitivity of the information stored in the compromised mailboxes. A CVSS v3.1 score of 7.7 (HIGH) indicates a significant risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnsure the \u003ccode\u003eauth_username_chars\u003c/code\u003e setting in Dovecot is not cleared to prevent SQL injection vulnerabilities as described in CVE-2026-24031.\u003c/li\u003e\n\u003cli\u003eMonitor Dovecot configuration files for changes to the \u003ccode\u003eauth_username_chars\u003c/code\u003e setting using file integrity monitoring rules.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided below to detect attempts to authenticate with usernames containing potentially malicious characters based on the expected character set defined by \u003ccode\u003eauth_username_chars\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpgrade Dovecot to the latest patched version to address this vulnerability and other potential security issues.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T00:45:37Z","date_published":"2024-01-25T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-03-dovecot-auth-bypass/","summary":"A misconfiguration vulnerability in Dovecot (CVE-2026-24031) allows authentication bypass and user enumeration when the `auth_username_chars` setting is cleared, potentially leading to unauthorized access to mailboxes.","title":"Dovecot SQL Authentication Bypass via Misconfigured Username Characters","url":"https://feed.craftedsignal.io/briefs/2026-03-dovecot-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Open-Xchange","version":"https://jsonfeed.org/version/1.1"}