StalwartLabs Stalwart up to 0.16.19 OAuth Registration registration.rs redirect

Summaryinfo

A vulnerability, which was classified as problematic, has been found in StalwartLabs Stalwart up to 0.16.19. This vulnerability affects unknown code of the file crates/http/src/auth/oauth/registration.rs of the component OAuth Registration. This manipulation of the argument redirect causes redirect. This vulnerability appears as CVE-2026-81036. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in StalwartLabs Stalwart up to 0.16.19. Affected by this vulnerability is an unknown functionality of the file crates/http/src/auth/oauth/registration.rs of the component OAuth Registration. The manipulation of the argument redirect with an unknown input leads to a redirect vulnerability. The CWE definition for the vulnerability is CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. As an impact it is known to affect integrity. The summary by CVE is:

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that requirement is false in the shipped settings, so the supplied redirect value is neither matched against a registered client nor otherwise constrained. The value is stored with the authorization code, and the login page reads it back and sends the browser to it with the code attached. A request naming a destination the attacker controls therefore delivers a valid authorization code there once the account holder authenticates, and because the token endpoint checks only that the redirect presented at exchange matches the one recorded with the code, the same party can exchange it for access and refresh tokens and read the account's mail.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-81036 since 08/26/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/26/2026). MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• StalwartLabs

Name

• Stalwart

Version

• 0.16.0
• 0.16.1
• 0.16.2
• 0.16.3
• 0.16.4
• 0.16.5
• 0.16.6
• 0.16.7
• 0.16.8
• 0.16.9
• 0.16.10
• 0.16.11
• 0.16.12
• 0.16.13
• 0.16.14
• 0.16.15
• 0.16.16
• 0.16.17
• 0.16.18
• 0.16.19

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion