CVE-2026-40205: Improper Authentication in Open-Xchange GmbH OX Dovecot Pro

This vulnerability in OX Dovecot Pro occurs because the remote token validation path accepts OAuth2 tokens that contain only one of the required scopes when multiple scopes are configured, whereas the local token validation path correctly requires all scopes. Consequently, the authorization policy is not properly enforced, permitting authentication with tokens that have only partial permissions. The recommended mitigation is to use local token validation where possible and update to a non-vulnerable version once available. The CVSS 3.1 score is 5.9 (medium severity) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N.

An attacker with an OAuth2 token that has only some of the required scopes can authenticate successfully due to improper enforcement of scope requirements in remote token validation. This could lead to unauthorized access with limited permissions. The confidentiality impact is low, integrity impact is high, and availability is not affected. No known public exploits exist.

Use local token validation where tokens can be validated locally, as it correctly enforces all required scopes. Update to a non-vulnerable version of OX Dovecot Pro when it becomes available. Since no patch links are provided, monitor vendor advisories for official fixes. There are no known exploits in the wild at this time.