CVE-2023-27582: Authentication Bypass in github.com/foxcpp/maddy
Summary
CVE-2023-27582: Full authentication bypass if SASL authorization username is specified in github.com/foxcpp/maddy. Affects github.com/foxcpp/maddy versions >= 0.2.0, < 0.6.3. Fixed in 0.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/foxcpp/maddy is a Go package that provides functionality for email servers. It is designed to handle SMTP, IMAP, and other email protocols. The package is widely used in various email server applications.
Vulnerability Detail
This vulnerability allows for a full authentication bypass if the SASL authorization username is specified in github.com/foxcpp/maddy. An attacker can exploit this issue to gain unauthorized access to the email server, potentially compromising sensitive information and performing malicious actions.
How To Fix
Latest published version: v0.9.6 as of 23 Oct 2026
go get github.com/foxcpp/maddy@v0.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.3
This is the first release that contains the fix.
go get github.com/foxcpp/maddy@v0.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version as soon as possible.
Conclusion
The authentication bypass vulnerability in github.com/foxcpp/maddy allows attackers to gain unauthorized access to email servers. Users should update to version 0.6.3 or later to mitigate this vulnerability.
See every vulnerability recorded for github.com/foxcpp/maddy →
FAQ
This vulnerability allows an attacker to bypass authentication and gain unauthorized access to the email server, potentially compromising sensitive information and performing malicious actions.
Versions 0.2.0 to 0.6.2 of github.com/foxcpp/maddy are affected by this vulnerability.
There are currently no known exploits for this vulnerability.
Yes, users should update their version of github.com/foxcpp/maddy to version 0.6.3 or later to fix this vulnerability.
You can find more information about this vulnerability in the vulnerability report at https://pkg.go.dev/vuln/GO-2023-1630.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/foxcpp/maddy.
