CVE-2026-81036: URL Redirection to Untrusted Site ('Open Redirect') in stalwartlabs stalwart

CVE-2026-81036 describes an open redirect vulnerability in stalwartlabs' Stalwart Mail Server affecting versions up to 0.16.19. The OAuth redirect target is not validated against registered clients when client authentication is disabled by default. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately in this configuration, allowing an attacker to specify an arbitrary redirect URI. This URI is stored with the authorization code and later used to redirect the user after login. Because the token endpoint only verifies that the redirect URI at token exchange matches the stored one, an attacker controlling the redirect URI can obtain valid authorization codes and exchange them for access and refresh tokens, thereby accessing the victim's mail.

An attacker can trick a user into authenticating and then redirect them to a malicious site with a valid authorization code. The attacker can then exchange this code for OAuth tokens without needing client authentication, gaining unauthorized access to the victim's mail account. This results in a high-impact compromise of user confidentiality and account integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling OAuth or enabling client authentication requirements if configurable. Monitor vendor channels for updates and apply official patches once released.