Executive brief
Stalwart Mail Server is an all-in-one mail and collaboration platform that handles email authentication through OAuth. By default, the server does not validate that OAuth redirect URLs are registered, allowing an attacker to intercept authorization codes and redirect users to a malicious site they control. Once a user logs in, the attacker receives a valid authorization code they can exchange for access tokens, granting them the ability to read the victim's emails and access their account.
Technical details
This is an OAuth redirect target validation bypass in the OAuth registration component (crates/http/src/auth/oauth/registration.rs). The validation routine returns success immediately when client authentication is disabled, which is the default configuration. The attacker-supplied redirect URI is neither matched against registered clients nor constrained, and is stored with the authorization code. During authentication, the login page retrieves and uses this URI to redirect the browser with the code attached. The token endpoint only verifies that the redirect URI matches what was recorded with the code, so the attacker can use the same URI at both the authorization and token endpoints to exchange the code for valid access and refresh tokens. No special preconditions are required beyond the ability to send a crafted OAuth authorization request; exploitation succeeds once the legitimate user authenticates.
Affected products
- Stalwart Labs Stalwart Mail Server v0.16.19 and earlier
Timeline
- 2026-08-26: disclosed