CVE-2026-73208: Improper Authentication in Open-Xchange GmbH OX Dovecot Pro

This vulnerability arises because OX Dovecot Pro treats the audience claim in OAuth2 tokens as a substitute for the scope claim when the latter is missing. Since audience and scope represent different concepts, a token without relevant permissions can be accepted if its audience claim coincides with a configured scope name. This improper authentication flaw allows attackers to gain unauthorized access by presenting tokens not intended for that purpose. The vulnerability also highlights potential misconfigurations in identity providers that fail to issue scope claims. The vendor advises ensuring scope claims are always issued and that scope names do not match audience values. No public exploit code is currently available.

An attacker can authenticate to OX Dovecot Pro using an OAuth2 token that lacks a scope claim but has an audience claim matching a configured scope name. This grants unauthorized access that should have been denied, potentially exposing sensitive information or functionality. The vulnerability affects confidentiality and integrity but not availability. No known exploits are publicly available.

Ensure that the identity provider issues a scope claim for all tokens used with OX Dovecot Pro. Verify that configured scope names do not match audience claim values to prevent improper token acceptance. Update to a non-vulnerable version of OX Dovecot Pro when available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.