CVE-2026-73208: High severity vulnerability
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the identity provider to always include a scope claim in OAuth2 token responses for tokens used with Dovecot (so that scope is not missing and the audience claim is not substituted).
Identity provider (OAuth2/OIDC) used with Dovecot scope claim issuance for tokens used with Dovecot = Ensure a scope claim is included in token responses for all tokens used with Dovecot - Configuration
Change Dovecot’s configured scope names/required scopes so they cannot match audience claim values used by tokens.
Dovecot OAuth2 token scope configuration configured scope names = Do not allow configured required scope names to match any audience values
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Dovecot deployments using OAuth2 tokens are exposed when a token response can omit the scope claim and an audience value matches a configured required scope name. The issue can also conceal an identity provider configuration that is not issuing scopes.
What does an attacker need to exploit it?
An attacker needs a token intended for a different purpose whose audience claim happens to match a configured required scope name. No authentication credentials or user interaction are required according to the supplied vector, but the attack complexity is high.
What should be done if an update cannot be applied immediately?
Ensure the identity provider issues a scope claim for every token used with Dovecot. Also ensure configured scope names do not match possible audience values.
How can administrators identify a potentially affected configuration?
Review token responses used by Dovecot to verify that they include a scope claim. Then compare configured required scope names against token audience values and investigate any matches.