CVE-2026-81036
Received Received - Intake

OAuth Redirect Validation Bypass in Stalwart Mail Server

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that requirement is false in the shipped settings, so the supplied redirect value is neither matched against a registered client nor otherwise constrained. The value is stored with the authorization code, and the login page reads it back and sends the browser to it with the code attached. A request naming a destination the attacker controls therefore delivers a valid authorization code there once the account holder authenticates, and because the token endpoint checks only that the redirect presented at exchange matches the one recorded with the code, the same party can exchange it for access and refresh tokens and read the account's mail.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-81036
EUVD
EUVD-2026-66612

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
stalwart mail_server *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Stalwart Mail Server fails to validate OAuth redirect targets against registered destinations in its default setup. When client authentication is disabled, the server immediately accepts any redirect URL, stores it with an authorization code, and later redirects users to that URL with the code attached. Attackers can exploit this by providing a malicious redirect URL, capturing valid authorization codes, and exchanging them for access tokens to read the victim's mail.

Impact Analysis

If you use Stalwart Mail Server with OAuth enabled, an attacker could trick you into authenticating, then steal your authorization code and gain access to your mail account. This could lead to unauthorized email access, data theft, or further account compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using this software may face compliance violations and potential legal consequences.

Mitigation Strategies

Disable OAuth client authentication requirement in Stalwart Mail Server configuration to enforce redirect target validation. Ensure all OAuth redirect URIs are registered and validated against the configured destinations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart