未評価
Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then...
CVE-2026-27855
SecPulse初出
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2026-27855 dovecot 修正版: 2.4.3-r0
- Debian DEBIAN-CVE-2026-27855 dovecot 修正版: 1:2.3.13+dfsg1-2+deb11u3
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communcations are secured, and if possible switch to OAUTH2 or SCRAM. No publicly available exploits are known.
参照URL
- advisory documentation.open-xchange.com
- advisory github.com
- advisory nvd.nist.gov