CVE-2026-81036Disclosure

LOWCVSS 8.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that requirement is false in the shipped settings, so the supplied redirect value is neither matched against a registered client nor otherwise constrained. The value is stored with the authorization code, and the login page reads it back and sends the browser to it with the code attached. A request naming a destination the attacker controls therefore delivers a valid authorization code there once the account holder authenticates, and because the token endpoint checks only that the redirect presented at exchange matches the one recorded with the code, the same party can exchange it for access and refresh tokens and read the account's mail.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-601

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
4 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-08-27); latest day: 1
4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-27	3	Disclosure3
2026-08-28	1	General1

Full discourse4 posts

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs44d
General
CVE-2026-81036 Stalwart Mail Server OAuth redirect validation bypass could let attackers intercept authorisation codes and take over mail accounts through phishing links Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-08-26/TIER_2_CVE-2026-81036.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement
Post summary
The report details an OAuth redirect validation bypass (CVE-2026-81036) in Stalwart Mail Server, describing how attackers could hijack authorization flows, but it does not confirm active exploitation, provide a patch, or explicitly share PoC code.
0000059
59 followersView on X
Infoflowcloud@infoflowcloud46d
Disclosure
🚨*CVE* CVE-2026-81036 Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/… https://www.cve.org/CVERecord?id=CVE-2026-81036 ----- Traducción: CVE-2026-81036 Sta… https://infoflow.cloud`
Post summary
A new CVE, CVE-2026-81036, is disclosed – it details an OAuth redirect verification flaw in the default configuration of Stalwart Mail Server, with no PoC, exploit code, patch information, or evidence of active exploitation.
0000027
102 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-81036 Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/… https://www.cve.org/CVERecord?id=CVE-2026-81036
Post summary
The text discloses CVE-2026-81036 for Stalwart Mail Server, noting a missing OAuth redirect validation. No patch, exploit, or active usage is reported.
000001.2K
58.0K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds46d
Disclosure
CVE-2026-81036 Stalwart Mail Server OAuth Redirect Vulnerability Allows Mail Acc... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-81036 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post announces the new CVE-2026-81036 for Stalwart Mail Server, presenting only a reference link without additional technical or exploit information.
00000122
4.1K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-81036

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObsGeneral

The report details an OAuth redirect validation bypass (CVE-2026-81036) in Stalwart Mail Server, describing how attackers could hijack authorization flows, but it does not confirm active exploitation, provide a patch, or explicitly share PoC code.

Infoflowcloud@infoflowcloudDisclosure

A new CVE, CVE-2026-81036, is disclosed – it details an OAuth redirect verification flaw in the default configuration of Stalwart Mail Server, with no PoC, exploit code, patch information, or evidence of active exploitation.

CVE@CVEnewDisclosure

The text discloses CVE-2026-81036 for Stalwart Mail Server, noting a missing OAuth redirect validation. No patch, exploit, or active usage is reported.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces the new CVE-2026-81036 for Stalwart Mail Server, presenting only a reference link without additional technical or exploit information.