Stalwart Mail Server CVE-2026-81036

The vulnerability is exploitable against any Stalwart Mail Server deployment where the OAuth client authentication requirement is disabled - specifically where client_auth_required is false, which is the default in shipped settings, meaning no administrator misconfiguration is required to be exposed. The attacker requires only network access to the OAuth authorization endpoint and the ability to deliver a crafted link to a target user. Exploitation is bounded by the requirement for active user interaction (UI:A): the target must follow the crafted link and complete authentication, ruling out fully automated mass exploitation. Deployments where client_auth_required has been explicitly set to true are not affected, as the validation bypass is gated entirely on that flag. No specific platform, version subrange beyond the general through-0.16.19 ceiling, or non-default feature enablement is required beyond the shipped defaults.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms this is a remotely exploitable, low-complexity attack requiring no privileges but needing active user interaction - the victim must follow a crafted link and authenticate through the attacker's phishing flow. The impact metrics VC:H and VI:H reflect full email account compromise, including read access to all mail and the ability to manipulate account state via the obtained refresh token. No exploitation has been confirmed by CISA KEV, and EPSS data was absent from the available intelligence, leaving exploitation probability unquantified by those signals. The technical bar is nonetheless low: constructing a valid OAuth authorization request with an attacker-controlled redirect_uri requires no special tooling and is feasible for any competent threat actor conducting targeted credential-theft campaigns. The primary risk-reducing factor is UI:A - the victim must actively click the crafted link and complete authentication - which prevents fully automated mass exploitation but provides little protection against spear-phishing targeting high-value mailbox holders. The default-vulnerable configuration is the most operationally significant signal here: no administrator misconfiguration is required to be exposed, making this a realistic risk across all unpatched default deployments.

An attacker targeting a specific Stalwart Mail Server user constructs an OAuth authorization request URL pointing to a legitimate Stalwart instance but specifying an attacker-controlled redirect_uri parameter. The attacker delivers this link via phishing email; the target follows it, is presented with a normal-looking Stalwart login page, and authenticates successfully - upon completion, the server forwards the authorization code to the attacker's endpoint. The attacker immediately presents this code alongside the same redirect_uri to the Stalwart token endpoint and receives valid access and refresh tokens, granting persistent full read and write access to the victim's mailbox.