CVE-2026-73208

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead to unauthorized access, as a token with no relevant permissions might be accepted if its intended recipient value matches a configured scope name.

This vulnerability is rated as Important because an attacker holding a valid token issued for another application can bypass authorization checks and gain unauthorized access to mailboxes. In standard Red Hat Enterprise Linux installations, Dovecot defaults to local system user authentication, leaving OAuth2 disabled unless explicitly configured by an administrator. Consequently, only environments that have explicitly enabled OAuth2 authentication and connect to an Identity Provider that omits token scope claims are susceptible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that the identity provider issues a scope claim for all tokens used with Dovecot. Additionally, verify that configured scope names in Dovecot do not match audience values from the identity provider. A restart of the Dovecot service may be required for configuration changes to take effect.