Skip to content
Fencer Vulns
critical 9.1

CVE-2023-27582 json

Full authentication bypass if SASL authorization username is specified

published 2023-03-13 3 y ago modified 2026-09-10 1 mo ago also GHSA-4g76-w3xw-2x6w , GO-2023-1630 , EUVD-2023-0863

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified username, it is accepted as is after checking the credentials for the authentication username. maddy 0.6.3 includes the fix for the bug. There are no known workarounds.

Patch / fix

  • go github.com/foxcpp/maddy 0.6.3
  • maddy_project maddy 0.6.3
  • maddy Alpine 3.24, Alpine 3.23 0.6.3-r0

alpine advisories ALPINE-CVE-2023-27582

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction

1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/foxcpp/maddy
>=0.2.0, <0.6.3
0.6.3

Affected products

  • foxcpp maddy

Classification

Weakness
  • CWE-287 Improper Authentication
  • CWE-305 Authentication Bypass by Primary Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.