CVE-2026-33603
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
46/100
Published: 2026-05-12
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
No Auth
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
High
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
None
A:
None
Description
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and client as MITM proxy. Install fixed version. No publicly available exploits are known.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| dovecot | dovecot | < 2.4.4 |
| open-xchange | dovecot | < 3.1.5 |
References & Advisories (1)
Vendor Advisory