OAuth Redirect URI Validation Flaw in Stalwart Mail Server by Stalwart Labs

CVE-2026-81036

What is CVE-2026-81036?

The Stalwart Mail Server is vulnerable due to a lack of validation for the OAuth redirect target in its default settings. When the client-authentication requirement is disabled, the server does not match the redirect URI against any registered destinations. This opens the door for attackers to exploit the authorization code process, allowing them to redirect users to an attacker-controlled site. Once the user grants access, the attacker can capture the valid authorization code and exchange it for access and refresh tokens, potentially gaining unauthorized access to the victim's email and sensitive data.

References