CVE-2026-73208

Dovecot's OAuth2 authentication mishandles token validation: when the identity provider's token response contains no scope claim, Dovecot substitutes the audience claim in its place and checks it against the configured required scopes, even though the audience only names a token's intended recipient, not what the token is allowed to do. An attacker who holds a valid token minted for a different purpose can therefore authenticate if that token's audience value happens to match a scope name configured in Dovecot, which requires a value collision and thus corresponds to the high attack complexity in the CVSS score. The attacker gains access they should have been denied — potentially including mailbox access with confidentiality and integrity impact — using a token that carries no relevant permissions. Affected parties are Dovecot deployments that authenticate via OAuth2 against an identity provider that omits scope claims (or where configured scope names collide with audience values), and the flaw also masks IdP misconfigurations in which no scopes are being issued at all. No public proof-of-concept or known exploitation exists; EPSS is 0.3% and the CVE is not in CISA KEV.

What to do: Upgrade Dovecot to a non-vulnerable version per the Open-Xchange/vendor advisory (specific fixed version numbers are not given in the available data). Until you can patch, ensure your identity provider issues a scope claim on every token used with Dovecot, and verify that no configured scope name matches any token audience value. Also review IdP configuration, since this bug can hide a misconfiguration where scopes are not issued at all.