This vulnerability involves improper neutralization of special elements in an SQL command (SQL Injection) within OX Dovecot Pro's SQL-based authentication mechanism. Specifically, if the admin clears the auth_username_chars configuration, it enables bypassing authentication for any user and facilitates user enumeration. The CVSS 3.1 base score is 7.7, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. No public exploits are currently known. The vendor advisory from Red Hat references this CVE but does not explicitly state patch availability in the provided content.

Successful exploitation allows attackers to bypass authentication controls and enumerate users, potentially leading to unauthorized access and disclosure of sensitive information. The integrity of the authentication process is compromised, and confidentiality is highly impacted. Availability impact is low.

Administrators should avoid clearing the auth_username_chars setting to prevent exploitation. If clearing this setting is necessary, upgrading to the latest fixed version of OX Dovecot Pro is recommended. Patch status is not explicitly confirmed in the vendor advisory content provided; therefore, check the vendor advisory for current remediation guidance.