ALPINE-CVE-2026-27855
Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If authentication happens over unsecure connection, switch to SCRAM protocol. Alternatively ensure the communcations are secured, and if possible switch to OAUTH2 or SCRAM. No publicly available exploits are known.
ALPINE-CVE-2026-27855
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ALPINE-CVE-2026-27855
dovecot
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.3-r0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
dovecot
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.3-r0
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.3-r0"
}
]
}
],
"package": {
"name": "dovecot",
"purl": "pkg:apk/alpine/dovecot?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-27855.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.3-r0"
}
]
}
],
"package": {
"name": "dovecot",
"purl": "pkg:apk/alpine/dovecot?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-27855.json"
},
"ecosystem_specific": {}
}
]Publisher severity
No explicit severity was provided.
- Event
- #54215 · Revision 1
- Added to Heist Feed
- Publisher date