CVE-2026-42008: Improper Authentication in Open-Xchange GmbH OX Dovecot Pro

This vulnerability arises from OX Dovecot Pro's handling of authentication data forwarded by hosts designated as trusted proxies. The forwarded information is not isolated from internal authentication fields, enabling a trusted proxy host to inject values that authenticate as any user without requiring the user's password. This affects deployments that use a password database honoring fields permitting passwordless authentication. Restricting trusted proxy networks to fully controlled hosts mitigates risk. No official patch or remediation level is stated in the available data.

An attacker controlling a host listed as a trusted proxy can impersonate any user without knowing their password, potentially bypassing authentication controls. This could lead to unauthorized access to user accounts in affected deployments. Deployments not using trusted proxies or not honoring passwordless authentication fields are not impacted. There are no known public exploits in the wild.

Restrict the list of trusted proxy networks strictly to hosts fully under your control to prevent unauthorized hosts from exploiting this vulnerability. Update to a non-vulnerable version when available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.