A flaw in OX Dovecot Pro authentication caching allows for potential session misattribution, posing a high risk to identity integrity and unauthorized data access.

This vulnerability involves improper state consistency (CWE-1250) in passdb and userdb drivers, where the system fails to maintain unique cache keys for different users. An unauthenticated attacker can exploit this logic error to potentially access another user session following a successful initial login.

The exploitation of this vulnerability can lead to unauthorized access to user accounts, resulting in significant data compromise and a total loss of confidentiality and integrity for affected mail stores. Given the CVSS score of 7.4, this is classified as a high-severity issue that could lead to widespread service disruption and loss of user trust if not addressed promptly.

Immediate Action: Update OX Dovecot Pro to the latest patched version provided by Open-Xchange, or immediately disable caching globally or for the specific impacted passdb and userdb drivers.

Proactive Monitoring: Review authentication and access logs for unusual patterns, such as multiple user logins originating from the same session identifier or rapid switches between different user accounts.

Compensating Controls: Implement strict network-level access controls and ensure that authentication services are isolated from untrusted segments to minimize the potential for exploitation attempts.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a significant risk to the integrity of user authentication sessions. Administrators must prioritize the application of vendor-supplied patches or the immediate disablement of the vulnerable caching features to prevent potential account takeover scenarios. Monitoring for anomalous authentication behavior is recommended until the fix is deployed across the environment.