CVE-2026-27855

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communcations are secured, and if possible switch to OAUTH2 or SCRAM. No publicly available exploits are known.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-294

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-278565.9Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine CVE-2026-278577.5Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client CVE-2026-278587.5Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacke CVE-2026-278595.3A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message ca CVE-2026-27869.8Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thun CVE-2026-278605.3If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially CVE-2026-278674.8An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who h CVE-2026-278686.9An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) wh CVE-2026-278696.9An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) wh CVE-2026-27879.8Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8 CVE-2026-278704.8An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who h CVE-2026-278712.9Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue af