---
id: 6544
title: "CVE-2026-24031 PoC: Dovecot SQL authentication bypass and user enumeration"
cve: CVE-2026-24031
cvss: 7.7
vendor: "Open-Xchange"
product: "Dovecot"
affected_versions: "Dovecot >= 2.4.0, < 2.4.3; OX Dovecot Pro >= 3.1.0, < 3.1.4; requires SQL passdb and empty auth_username_chars"
source_domain: github.com
source_url: "https://github.com/aramosf/CVE-2026-24031"
published_at: "2026-08-12T23:19:05Z"
tags: ["public-poc", "authentication-bypass", "sql-injection", "pre-auth", "email-security", "authentication", "dovecot", "user-enumeration", "cve", "poc", "cve-2026-24031", "mail-server"]
phying_url: "https://phying.com/item/6544"
lang: en
---

# CVE-2026-24031 PoC: Dovecot SQL authentication bypass and user enumeration

## Summary

A Python PoC for CVE-2026-24031, a Dovecot SQL passdb injection allowing authentication bypass and user enumeration when auth_username_chars is emptied; validated on Dovecot 2.4.0 with PostgreSQL.

## Why it matters

The public PoC demonstrates that the vulnerable configuration can turn a mail authentication query into unauthenticated remote account takeover and user enumeration. Restore a safe auth_username_chars value and upgrade to Dovecot 2.4.3 or OX Dovecot Pro 3.1.4 or later.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-24031
- **CVSS:** 7.7
- **Vendor:** Open-Xchange
- **Product:** Dovecot
- **Affected versions:** Dovecot >= 2.4.0, < 2.4.3; OX Dovecot Pro >= 3.1.0, < 3.1.4; requires SQL passdb and empty auth_username_chars
- **Published:** 2026-08-12T23:19:05Z
- **Original:** https://github.com/aramosf/CVE-2026-24031
- **Phying News:** https://phying.com/item/6544