CVE-2026-24031 Analysis — Dovecot SQL-Based Authentication Bypass (an auth_username_chars Regression)
1. Overview Item Detail CVE ID CVE-2026-24031 Component Dovecot Core (SQL passdb/userdb authentication) Vulnerability class CWE-89 (SQL Injection) CVSS 3.1 7.7 (High) — AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L Affected versions OX Dovecot CE core 2.4.0–2.4.2, OX Dovecot Pro core 3.1.0–3.1.3 Fixed in CE core 2.4.3 , Pro core 3.1.4 Internal tracking ID DOV-8781 Discovery / disclosure 2026-02-23 /…
CVE-2026-24031 is a vulnerability affecting Dovecot Core (SQL passdb/userdb authentication) that allows bypassing authentication for any user and enabling user enumeration. The issue stems from a regression introduced during the 2.4 settings-system refactor, where an explicitly-requested SQL escape function is discarded. This vulnerability is triggered when auth_username_chars is cleared by an admin, which effectively disables the first-line defense against dangerous characters in SQL/LDAP queries, file paths, and more.
By default, auth_username_chars restricts characters to letters, digits, and specific symbols. However, when set to an empty string, it actually allows every byte (0x00–0xFF), stripping away the protection against SQL metacharacters like single quotes or semicolons. The real problem arises when Dovecot builds its SQL query string using variables like %u, which must be escaped to prevent SQL injection.
The sql_escape_string function is supposed to handle this, but with the aforementioned regression, the escaping is silently discarded when the username_chars_map is filled with 1s across the board. This allows attackers to bypass authentication entirely, making the vulnerability a significant security concern.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
