Search: CVE-2026-27855

CVE-2026-27855 is a medium severity vulnerability in Open-Xchange GmbH's OX Dovecot Pro affecting its OTP authentication mechanism. Under specific conditions—when authentication cache is enabled and the username is altered in the password database—OTP credentials can be cached, allowing replay of the same OTP response. An attacker who can observe an OTP exchange may reuse it to log in as the user. The vulnerability is mitigated by using secure communication protocols such as SCRAM or OAUTH2 or by securing the communication channel. No public exploits are known at this time.