CVE-2026-81036

Executive Summary

CVE-2026-81036 is an open redirect vulnerability (CWE-601) in Stalwart Mail Server's OAuth2 authentication flow. In the default configuration, the server fails to validate the redirect target supplied during OAuth authorization against registered client destinations. This allows an attacker to craft a malicious authentication link that, once clicked by a legitimate user, delivers a valid authorization code to the attacker-controlled destination. The attacker can then exchange this code for access and refresh tokens, gaining unauthorized read access to the victim's mailbox. The vulnerability carries a CVSS score of 8.1 (High) and is currently UNPATCHED, affecting all deployments running the default configuration.

Technical Analysis

The vulnerability resides in the OAuth2 authorization code flow implemented by Stalwart Mail Server. The NVD description identifies the affected validation routine located in crates/http/src/auth/oauth/registration.rs. The flaw is rooted in the following mechanism:

1. Missing Redirection Validation: During the OAuth2 authorization request, the server does not compare the supplied redirect_uri parameter against any registered destination in its default configuration. The validation routine is supposed to enforce this check when client authentication is required; however, in the shipped settings, the client-authentication requirement is disabled (set to false). Consequently, the validation routine returns success immediately without inspecting the redirect value at all.

2. Auth Code Binding: Instead of rejecting the unregistered redirect target, the server stores the supplied redirect value alongside the authorization code. When the account holder completes authentication on the login page, the server reads back this stored redirect value and issues an HTTP redirect to the browser, appending the valid authorization code as a query parameter to the URL.

3. Token Exchange Weakness: The token endpoint performs a consistency check between the redirect presented at token exchange time and the one recorded with the authorization code. Because the attacker supplied the redirect value during the initial authorization request, they can present the same (attacker-controlled) redirect value during the token exchange phase, passing this check. The endpoint does not verify that the redirect matches a registered or trusted OAuth client.

From a code-flow perspective, the issue is not an input validation bypass but rather an absent validation path — the check exists but is conditionally skipped based on a configuration flag that is false by default. This makes the vulnerability a default-insecure configuration issue more than a logic error in the validation routine itself. An administrator who enables the client-authentication requirement would neutralize this flaw; however, the default shipped configuration leaves all installations vulnerable out of the box.

The attack surface is the public-facing OAuth2/OpenID Connect login endpoint, which is exposed on the mail server's web interface. No authentication is required to craft the malicious authorization URL — the attacker only needs to induce a valid user to click the link. The confidentiality impact is high (mailbox contents are fully readable once tokens are obtained), and the integrity impact is also rated high, as token theft could enable mailbox rule creation, message deletion, or further account manipulation. Availability is unaffected.

Exploitation Scenarios

The attack chain for CVE-2026-81036 proceeds as follows:

Step 1 — Reconnaissance and Target Identification The attacker identifies Stalwart Mail Server instances exposed to the internet. Shodan queries such as title:"Stalwart Mail" or http.title:"Stalwart Mail Server" can reveal candidates. The attacker confirms the OAuth2 login page is reachable and that the server responds to standard OAuth2 authorization endpoint queries. No prior access or credentials are needed.

Step 2 — Triggering the Flaw The attacker crafts a malicious URL pointing to the server's OAuth2 authorization endpoint, supplying an attacker-controlled redirect URI (e.g., https://attacker.example/steal). Because the client-authentication requirement is disabled by default, the validation routine in crates/http/src/auth/oauth/registration.rs returns success without comparing this redirect against any registered client. The attacker then lures a legitimate account holder to click this link via phishing email, social engineering, or other delivery methods.

Step 3 — Payload and Execution When the victim clicks the link, they are presented with the legitimate login page. Upon authenticating successfully, the server issues an HTTP redirect to the attacker-supplied URL with the valid authorization code appended as a query parameter. The victim's browser follows this redirect, delivering the authorization code to the attacker's server. At the vulnerability-class level, this is a classic open-redirect-with-token-leakage attack pattern, abusing the trust a user places in the legitimate login domain.

Step 4 — Post-Exploitation Impact The attacker now possesses a valid authorization code bound to the victim's account. The attacker presents this code to the token endpoint along with the same attacker-controlled redirect URI. Because the token endpoint only verifies that the redirect matches the one recorded with the code, the exchange succeeds. The attacker receives access and refresh tokens, granting full API access to the victim's mailbox. The attacker can read all emails, extract sensitive data (credentials, financial information, confidential communications), and maintain persistent access via the refresh token even after the short-lived access token expires.

No public proof-of-concept or exploit code is available; this exploitation chain is inferred entirely from the vulnerability description. However, the mechanism described is straightforward and requires no exotic tooling — any attacker with basic HTTP knowledge can implement this in minutes once the target is identified.

Impact Assessment

CVSS Sub-Score Analysis: The vulnerability scores 8.1 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The network attack vector (AV:N) and low complexity (AC:L) mean a remotely positioned attacker with standard skill can exploit this. No privileges are required (PR:N), but user interaction (UI:R) is necessary — the victim must click the malicious link. The scope is unchanged (S:U), keeping the impact confined to the mail server. Confidentiality impact is high (C:H) as complete mailbox contents are exposed; integrity impact is likewise high (I:H) since the attacker can alter mailbox state. Availability impact is none (A:N).

Business Impact: For organizations running Stalwart Mail Server, full compromise of individual mailboxes leads directly to data breaches, violation of regulatory compliance (GDPR, HIPAA, SOX depending on jurisdiction), loss of intellectual property, and reputational damage. Email accounts frequently serve as the pivot point for business email compromise (BEC) attacks, enabling lateral movement into other corporate systems.

Affected Systems: All Stalwart Mail Server deployments using default configuration. The vendor has not provided a version range in the CVE data, and patch confidence is 0/4 — no tracked source has identified a fix. Organizations that have disabled the OAuth client-authentication requirement or never modified it are affected. Administrators who enable the client-authentication requirement can potentially mitigate the vulnerability, but this is a configuration workaround, not an official vendor patch.

Blast Radius: Each compromised account exposes the full mailbox content and all linked services using OAuth. If the mail server is integrated with other systems via IMAP/POP3/SMTP credentials, those may also be at risk. Because the refresh token grants persistent access, the blast radius extends beyond the initial theft window.

Detection Guidance

Detection of this vulnerability focuses on two areas: (1) detecting open-redirect abuse in web logs and (2) detecting anomalous OAuth2 token exchange patterns. The rules below target observable behaviors.

Sigma Rule

title: Suspicious OAuth Authorization Redirect to External Host
id: 3f9c1a2e-5b8d-4e7a-9c3f-2d1b0a8e6f5c
status: experimental
description: Detects OAuth2 authorization requests to Stalwart Mail Server with redirect URIs pointing to non-registered external domains, indicating potential open-redirect token theft (CVE-2026-81036).
author: Valters IT Cyber Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: stalwart
  service: mail
detection:
  selection:
    cs-uri-query|contains:
      - 'response_type=code'
      - 'redirect_uri='
  filter_known_domains:
    cs-uri-query|contains:
      - 'redirect_uri=https://mail.'
      - 'redirect_uri=https://login.'
      - 'redirect_uri=https://auth.'
  filter_static_assets:
    cs-uri-stem|endswith:
      - '.css'
      - '.js'
      - '.png'
      - '.ico'
  condition: selection and not filter_known_domains and not filter_static_assets
  timeframe: 5m
level: medium
falsepositives:
  - Legitimate custom OAuth client applications
  - Redirect URIs using IP addresses or localhost for testing
fields:
  - src_ip
  - cs-uri-query
  - cs-host
tags:
  - attack.t1190
  - cve.2026-81036
  - cwe.601

YARA Rule

rule CVE_2026_81036_Stalwart_OAuth_Open_Redirect
{
    meta:
        author = "Valters IT Cyber Intelligence"
        description = "Detects OAuth authorization request patterns indicative of CVE-2026-81036 open redirect abuse in Stalwart Mail Server logs or captured traffic"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-81036"
        severity = "high"
        cve = "CVE-2026-81036"
        cwe = "CWE-601"
    strings:
        $auth_path = "oauth" ascii wide nocase
        $auth_code = "response_type=code" ascii wide nocase
        $redirect = "redirect_uri=" ascii wide nocase
        $external_redirect = /redirect_uri=https?:\/\/[^\/]*(?!stalwart|mail\.|login\.)[^\/]*\// ascii wide nocase
        $client_id = "client_id=" ascii wide nocase
        $state_param = "state=" ascii wide nocase
        $token_response = "access_token" ascii wide nocase
        $refresh_token = "refresh_token" ascii wide nocase
    condition:
        any of ($auth_path, $auth_code, $redirect, $client_id) and
        ($external_redirect or $state_param) and
        filesize < 2MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-81036 - Stalwart Mail OAuth Open Redirect Attempt"; flow:established,to_server; content:"GET"; http_method; content:"oauth"; http_uri; content:"response_type=code"; http_uri; content:"redirect_uri="; http_uri; pcre:"/redirect_uri=https?:\/\/[^\/]*(?!(\.)?stalwart|\.mail\.|\.login\.)/Ui"; classtype:attempted-user; sid:202681036; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve 2026-81036;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [ network where destination.port == 443 and
    url.path contains "oauth" and
    url.query contains "response_type=code" and
    url.query contains "redirect_uri=" and
    not url.query matches "redirect_uri=https://(mail|login|auth)\\."
  ]
  [ network where destination.port == 443 and
    url.path contains "token" and
    (http.request.body.content contains "grant_type=authorization_code" or
     url.query contains "grant_type=authorization_code")
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%oauth%")
| rex field=uri_query "redirect_uri=(?<redirect_uri>[^&]+)"
| rex field=uri_query "response_type=(?<response_type>[^&]+)"
| where like(response_type, "code") AND NOT like(redirect_uri, "https://mail.*") AND NOT like(redirect_uri, "https://login.*") AND NOT like(redirect_uri, "https://auth.*")
| stats count by src_ip, uri_query, http_user_agent
| sort - count
| where count > 3
| table _time, src_ip, uri_query, http_user_agent, count

Wazuh OSSEC Rule

<group name="web,staltwart,oauth,">
  <rule id="100836" level="12">
    <if_sid>31122</if_sid>
    <field name="url">\.*oauth.*</field>
    <field name="url">\.*response_type=code.*</field>
    <regex>redirect_uri=</regex>
    <description>CVE-2026-81036: Possible OAuth open redirect attempt against Stalwart Mail Server - redirect_uri parameter present in OAuth authorization request</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>t1190</id>
    </mitre>
  </rule>

  <rule id="100837" level="15">
    <if_sid>100836</if_sid>
    <regex>redirect_uri=https?://(?!mail\.|login\.|auth\.|staltwart\.)</regex>
    <description>CVE-2026-81036: OAuth redirect_uri points to external unregistered destination - potential token theft in progress</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>t1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CVE-2026-81036 is UNPATCHED as of this writing. Patch confidence is 0/4 — no tracked source (vendor advisory, distribution channels, or independent researchers) has reported a fix. The vendor has not published a patched version or official workaround.

1. Immediate Mitigations (until a vendor patch is available):

• Enable OAuth client authentication: The vulnerability is only present when the client-authentication requirement is disabled (the shipped default). Administrators should enable this requirement in the Stalwart Mail Server configuration. This forces the validation routine to compare redirect targets against registered clients, closing the open-redirect path.
• Disable or restrict external OAuth login: If OAuth is not absolutely required, disable the OAuth2/OpenID Connect login endpoint entirely and require traditional username/password authentication. This eliminates the attack surface completely.
• Deploy a reverse proxy: Place a reverse proxy or WAF in front of the mail server's web interface that validates redirect_uri parameters against an allowlist of approved destinations. Reject any authorization request containing a redirect URI not on the allowlist.
• User awareness training: Inform users about phishing links that appear to come from the mail server's domain. Instruct them to verify the URL after authentication and report any unexpected redirects.

2. Patch/Upgrade Steps:

• Monitor the Stalwart Mail Server project releases page and security advisories for a patched version.
• Subscribe to the vendor's security mailing list or RSS feed for immediate notification of a fix.
• When a patched version is released, upgrade all production instances. Test the upgrade in a staging environment first, validating that OAuth functionality works correctly with the fix applied.
• After upgrading, verify that the redirect validation is enforced even with default configuration settings.

3. Long-Term Hardening:

• Follow the principle of least privilege: limit which OAuth clients are registered and require strong client authentication.
• Periodically audit OAuth client registrations and remove unused or stale entries.
• Implement monitoring on OAuth token exchange endpoints, alerting on multiple rapid exchanges from the same source IP.
• Enable comprehensive web server logging that captures full query strings for forensic analysis (while redacting sensitive token values).
• Adopt a security baseline that requires all authentication flows to validate redirect URIs against a strict allowlist, regardless of configuration flags.
• Consider implementing additional factors such as IP-based access restrictions on the mail server web interface.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-81036 — Official NVD record with CVSS vector and description.
2. Stalwart Mail Server Official Site: https://stalw.art — Vendor project page for monitoring release notes and security advisories.
3. CWE-601 (Open Redirect): https://cwe.mitre.org/data/definitions/601.html — MITRE's classification of the vulnerability class.
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploitation of Public-Facing Application technique reference.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — No entry for CVE-2026-81036 as of 2026-01-01; monitor for updates.

Threat Actor Campaigns and Exploit-in-the-Wild Evidence: As of the publication date, there are no known threat actor campaigns exploiting CVE-2026-81036, no public proof-of-concept code, and no evidence of exploitation in the wild. The vulnerability is not listed on the CISA KEV catalog. However, given the straightforward exploitation chain and the high value of email accounts, active exploitation is considered likely once attackers discover the flaw. Security teams should treat this as a high-priority vulnerability to monitor, even absent current exploitation evidence.