A vulnerability in mutt before version 2.3.2 causes the hash_passwd used in IMAP auth_cram MD5 digest authentication to sometimes be truncated by one byte. This flaw affects the integrity of the authentication process but does not impact confidentiality or availability.