Vulnerabilities

TI-2026-56046 CVE-2026-81036 · GHSA-g6qf-h8rr-h574

Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

HIGH 72

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00389 Published 2026-08-26 No fix listed CWE-601

TI-2025-38045 CVE-2025-61600

MEDIUM 40

Stalwart is a mail and collaboration server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00562 Published 2025-10-02 Fixed in 0.13.4 CWE-400

TI-2025-36687 CVE-2025-59045

LOW 37

Stalwart is a mail and collaboration server.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00349 Published 2025-09-10 Fixed in 0.13.3 CWE-770

TI-2024-23261 CVE-2024-35187

HIGH 74

Stalwart Mail Server is an open-source mail server.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00738 Published 2024-05-16 Fixed in 0.8.0 CWE-863

TI-2024-23253 CVE-2024-35179

MEDIUM 63

Stalwart Mail Server is an open-source mail server.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00621 Published 2024-05-15 Fixed in 0.8.0 CWE-271