Skip to content
CVE-2026-24031 PoC: Dovecot SQL authentication bypass and user enumeration
github.com | tool | CVE-2026-24031 | #public-poc | #authentication-bypass | #sql-injection | #pre-auth | #email-security | #authentication | #dovecot | #user-enumeration | #cve | #poc | #cve-2026-24031 | #mail-server
Summary
A Python PoC for CVE-2026-24031, a Dovecot SQL passdb injection allowing authentication bypass and user enumeration when auth_username_chars is emptied; validated on Dovecot 2.4.0 with PostgreSQL.
Why it matters
The public PoC demonstrates that the vulnerable configuration can turn a mail authentication query into unauthenticated remote account takeover and user enumeration. Restore a safe auth_username_chars value and upgrade to Dovecot 2.4.3 or OX Dovecot Pro 3.1.4 or later.
- Vendor
- Open-Xchange
- Product
- Dovecot
- Affected versions
- Dovecot >= 2.4.0, < 2.4.3; OX Dovecot Pro >= 3.1.0, < 3.1.4; requires SQL passdb and empty auth_username_chars
- CVSS
- 7.7
- Published
- Collected