Stalwart Mail Server fails to validate OAuth redirect_uri values, an instance of CWE‑601. In the shipped default configuration client‑authentication is disabled, causing the validation logic to accept any supplied redirect_uri outright. The redirect_uri is stored alongside the authorization code, and the login page redirects the browser to it after the user authenticates. An attacker can supply a redirect_uri pointing to a domain they control, receive a valid authorization code once the victim logs in, and then exchange that code for access and refresh tokens. These tokens grant read access to the victim’s mailbox, exposing confidential email content.

Stalwart Mail Server, version 0.16.19, delivered by stalwartlabs. The vulnerability stems from the default configuration of this version and applies to any deployment that has not enabled client authentication or otherwise configured redirect_uri validation.

The CVSS score of 8.5 indicates a high‑severity flaw. The EPSS score is not available, so the probability of exploitation cannot be quantified precisely, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the OAuth flow; the attacker merely needs to craft an OAuth request with a chosen redirect_uri, obtain an authorization code after the user logs in, and use the token endpoint to receive credentials that grant read access to the victim’s mailbox. No prior privileged access or additional vulnerability is required, making the exploitation realistic and potentially rapid.