CVE-2026-73208: Improper Authentication in Open-Xchange GmbH OX Dovecot Pro

This vulnerability arises because OX Dovecot Pro treats the audience claim as a substitute for the scope claim when the latter is missing in an OAuth2 token response. The audience claim indicates the intended recipient of the token, not the permissions granted. If the audience claim matches a configured scope name, the system may incorrectly grant access, enabling an attacker holding a token intended for a different purpose to authenticate improperly. This flaw also conceals misconfigurations in the identity provider where scope claims are not issued. The recommended mitigation is to ensure the identity provider issues scope claims and to update to a non-vulnerable version of OX Dovecot Pro.

An attacker possessing a token without the appropriate scope permissions can authenticate successfully if the token's audience claim matches a configured scope name. This leads to unauthorized access with high confidentiality and integrity impact, as indicated by the CVSS score of 7.4. The vulnerability does not affect availability. No known public exploits exist at this time.

Update to a non-vulnerable version of OX Dovecot Pro when available. Ensure that the identity provider issues scope claims for all tokens used with Dovecot. Additionally, configure scope names so they do not match audience values to prevent improper authentication. Since no official patch links are provided, monitor vendor advisories for updates.