The OX Dovecot Pro email server contains a critical authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to user accounts.

This vulnerability is a SQL injection flaw (CWE-89) triggered when the admin clears the auth_username_chars configuration parameter. This misconfiguration allows unauthenticated attackers to bypass authentication mechanisms and enumerate valid users.

Successful exploitation of this flaw allows an attacker to bypass authentication entirely, leading to full unauthorized access to user mailboxes and potential data theft. With a CVSS score of 7.7, this represents a high severity risk that could result in significant business disruption, loss of sensitive correspondence, and severe reputational damage.

Immediate Action: Update OX Dovecot Pro to the latest patched version provided by the vendor. In the interim, ensure the auth_username_chars parameter is explicitly configured and not left empty.

Proactive Monitoring: Review authentication and SQL query logs for unusual patterns, such as unexpected character sequences or high volumes of failed login attempts, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads targeting authentication endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in a GitHub repository.

The severity of this authentication bypass necessitates immediate attention from security administrators. Organizations utilizing OX Dovecot Pro must verify their current version and apply vendor-supplied patches without delay to prevent unauthorized access. If patching is not immediately feasible, administrators must verify that the auth_username_chars setting is securely configured to mitigate the primary attack vector.