CVE-2026-40205

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1

Description An authentication flaw exists where remote token validation paths fail to enforce configured authorization policies when multiple scopes are required. An attacker possessing an OAuth2 token with only a subset of the necessary scopes can successfully authenticate, whereas local token validation correctly requires all specified scopes. This results in the acceptance of tokens that lack the full set of required permissions.

Recommendations Update to version 2.4.5-1.1. Use local token validation to ensure tokens are validated locally.