CVE-2026-27855CWE-294

Dovecot OTP authentication is vulnerable to replay attack under specific conditions

Medium · published March 27, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communcations are secured, and if possible switch to OAUTH2 or SCRAM. No publicly available exploits are known.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00400 · 33.2th percentile
Weakness
CWE-294 · Authentication Bypass by Capture-replay
Published
2026-03-27T08:10Z
EPSS history
Timeline
  • 27 MAR 08:10Z
    Dovecot OTP authentication is vulnerable to replay attack under specific conditions
    cvelistv5