CVE-2026-81036: Stalwart Mail Server Auth Bypass Flaw

CVE-2026-81036 Overview

CVE-2026-81036 is an open redirect vulnerability [CWE-601] in Stalwart Mail Server through version 0.16.19. The flaw resides in the OAuth authorization flow, where the server fails to validate redirect URIs against any registered destination in its default configuration. Attackers who trick an authenticated user into visiting a crafted authorization URL receive a valid authorization code at an attacker-controlled endpoint. The attacker can then exchange the code for access and refresh tokens and read the victim's mail.

Critical Impact
Successful exploitation delivers OAuth authorization codes to attacker-controlled URLs, enabling account takeover and full mailbox access without compromising user credentials.

Affected Products

Stalwart Mail Server through version 0.16.19
Deployments using the shipped default configuration where client authentication is disabled
OAuth authorization endpoint served by crates/http/src/auth/oauth/registration.rs

Discovery Timeline

2026-08-26 - CVE-2026-81036 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-81036

Vulnerability Analysis

The vulnerability originates in the OAuth dynamic client registration and authorization flow implemented in crates/http/src/auth/oauth/registration.rs. The redirect URI validation routine returns success immediately when the client-authentication requirement is disabled. Stalwart ships with this requirement set to false, so the redirect value supplied by a caller is neither matched against a registered client entry nor otherwise constrained.

The unvalidated redirect value is persisted alongside the authorization code. When the account holder loads the login page and authenticates, the server reads the stored value back and issues an HTTP redirect that sends the browser to that destination with the authorization code appended.

The token endpoint compensates in the wrong direction: it only checks that the redirect URI presented at code exchange matches the one recorded with the code. Because the attacker chose both values, this check passes trivially, and the code is exchanged for access and refresh tokens.

Root Cause

The root cause is a missing allowlist check on the OAuth redirect_uri parameter [CWE-601]. The default shipping configuration disables the client authentication path that would have enforced registered destinations, so no server-side comparison occurs before the value is stored and later used for the browser redirect.

Attack Vector

Exploitation is remote and requires user interaction. An attacker crafts an OAuth authorization request that names a redirect_uri under their control and delivers the link to a Stalwart user through phishing or a malicious page. After the victim authenticates against the legitimate Stalwart login page, the browser is redirected to the attacker's endpoint with a valid authorization code. The attacker then exchanges the code at the token endpoint for access and refresh tokens tied to the victim's mailbox. Technical details are available in the Vulncheck advisory and in Stalwart GitHub Issue #3205.

Detection Methods for CVE-2026-81036

Indicators of Compromise

OAuth authorize requests carrying redirect_uri parameters pointing to domains outside the organization's trusted allowlist.
Successful token exchanges from source IP addresses that differ from the IP address that completed the interactive login for the same account.
Unexpected refresh token issuance followed by IMAP or JMAP sessions from previously unseen user agents or geolocations.

Detection Strategies

Parse Stalwart HTTP access logs for /authorize endpoint hits and alert on redirect_uri hostnames not present in an approved list.
Correlate authorization code issuance events with subsequent token exchanges to flag mismatched client identifiers or redirect URIs.
Monitor mailbox access patterns for anomalous IMAP, JMAP, or SMTP sessions that begin shortly after an OAuth token grant.

Monitoring Recommendations

Forward Stalwart web and mail protocol logs to a centralized analytics platform and retain them for at least 90 days.
Alert on any OAuth client registration or authorization flow that occurs outside of change-managed integration windows.
Track refresh token usage per account and generate an alert when tokens are used from more than one autonomous system in a 24-hour window.

How to Mitigate CVE-2026-81036

Immediate Actions Required

Upgrade Stalwart Mail Server to a release later than 0.16.19 that enforces redirect_uri validation, and monitor the Stalwart GitHub repository for advisory updates.
Enable the OAuth client authentication requirement so the validation routine in registration.rs performs the redirect comparison rather than returning early.
Revoke existing OAuth access and refresh tokens after patching and require users to re-authenticate integrated clients.

Patch Information

Refer to the upstream project for a fixed release. The affected code path is documented in the Stalwart OAuth registration source and tracked in Stalwart GitHub Issue #3205. Administrators should apply the vendor-supplied patch that adds strict allowlist matching for OAuth redirect destinations.

Workarounds

Restrict access to the Stalwart OAuth endpoints with a reverse proxy or web application firewall that enforces an allowlist of registered redirect_uri values.
Require pre-registered OAuth clients only and disable dynamic client registration paths until the upgrade is deployed.
Educate users about phishing links that initiate OAuth flows and encourage reporting of unexpected consent prompts.

bash

# Example nginx allowlist for Stalwart OAuth authorize endpoint
location /authorize {
    if ($arg_redirect_uri !~* "^https://(app\.example\.com|mail\.example\.com)/oauth/callback") {
        return 400;
    }
    proxy_pass http://stalwart_backend;
}