CVE-2026-40205
published 2026-08-28CVE-2026-40205: An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the…
PriorityP334medium5.9CVSS 3.1
AVNACHPRLUINSUCLIHAN
EPSS
0.21%
10.8th percentile
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly requires all of them. The configured authorization policy is not enforced, so a token that was granted only part of the required permissions is accepted where it should have been rejected. Use local token validation where tokens can be validated locally. Update to non-vulnerable version. No publicly available exploits are known.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dovecot | dovecot | — | — |
| open-xchange_gmbh | ox_dovecot_ce | >= 2.3.11.2 < 2.4.5 | 2.4.5 |
| open-xchange_gmbh | ox_dovecot_pro | >= 2.3.11.2 < 2.3.22.2 | 2.3.22.2 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.0.0 < 3.0.7 | 3.0.7 |
| open-xchange_gmbh | ox_dovecot_pro | >= 3.1.0 < 3.1.6 | 3.1.6 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths
ghsa_unreviewed·2026-08-28
CVE-2026-40205 [MEDIUM] CWE-287 An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly requires all of them. The configured authorization policy is not enforced, so a token that was granted only part of the required permissions is accepted where it should have been rejected. Use local token validation where tokens can be validated locally. Update to non-vulnerable version. No publicly available exploits are known.
Red Hat
dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token
vendor_redhat·2026-08-28·CVSS 5.9
CVE-2026-40205 [MEDIUM] CWE-303 dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token
dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly requires all of them. The configured authorization policy is not enforced, so a token that was granted only part of the required permissions is accepted where it should have been rejected. Use local token validation where tokens can be validated locally. Update to non-vulnerable version. No publicly available exploits are known.
A flaw was found in Dovecot. An attacker with a partially valid OAuth2 token can bypass authorization
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-40205 dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token [fedora-all]
bugzilla·2026-09-01·CVSS 5.9
CVE-2026-40205 [MEDIUM] CVE-2026-40205 dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token [fedora-all]
CVE-2026-40205 dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly requires all of them. The configured authorization policy is not enforced, so a token that was granted only part of the required permissions is accepted where it should have been r
Bugzilla
CVE-2026-40205 dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token
bugzilla·2026-08-28·CVSS 5.9
CVE-2026-40205 [MEDIUM] CVE-2026-40205 dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token
CVE-2026-40205 dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly requires all of them. The configured authorization policy is not enforced, so a token that was granted only part of the required permissions is accepted where it should have been rejected. Use local token validation where tokens can be validated locally. Update to non-vulnerable version. No publicly available exploits are known.
2026-08-28
Published