CVE-2022-26562

What it actually does

The authentication module in provider/libserver/ECKrbAuth.cpp (and ECPamAuth.cpp in Zarafa) skips expiration checks for user accounts and passwords, allowing successful authentication with invalid credentials.

Why it matters to the business

Attackers obtain full unauthorized access to groupware systems and data, enabling account takeover and lateral movement; the absence of a listed fixed version and presence of public exploits heightens exposure across all affected deployments.

How an attack unfolds

An attacker issues a standard authentication request containing an expired username or password directly to the Kopano server; the flawed code path returns success instead of rejecting the request, granting an active session without further interaction.

How to fix it

Upgrade Kopano Core to the latest available release that resolves the expiration logic; if no fixed version exists, replace the affected authentication provider or enforce expiration validation through an external identity provider before requests reach the server.

How to confirm the fix worked

Test authentication with deliberately expired credentials from a non-production client and confirm rejection; review server logs for any successful logins tied to accounts marked expired in the user database.

Typical attack path

1. Scan for exposed Kopano Core or Zarafa instances
2. Collect or guess a username whose password or account is known to be expired
3. Submit authentication request to the affected endpoint
4. Receive authenticated session token due to bypassed checks
5. Access mailboxes, calendars, and other groupware resources

How to detect it

Search authentication logs for successful logins involving accounts flagged as expired in the directory; inspect process execution and network flows involving libserver authentication modules for unexpected patterns.

• ECKrbAuth.cpp
• ECPamAuth.cpp
• successful auth with expired password
• Kopano authentication bypass

What your security team should do

• Immediately restrict network access to the authentication service until a patch or workaround is applied
• Enable additional authentication layers such as MFA or external IdP validation
• Audit all recent successful logins for accounts that should have been expired
• Monitor vendor announcements for an official fixed release