Stalwart Mail Server contains a critical OAuth vulnerability where redirect URIs are not validated against registered destinations in the default configuration. The validation routine in the OAuth registration code returns success immediately when client-authentication is disabled, which is the default shipped setting. This allows an attacker to supply an arbitrary redirect URI, which gets stored with the authorization code. When a legitimate user authenticates, the authorization code is sent to the attacker-controlled destination. The attacker can then exchange the code for access and refresh tokens since the token endpoint only verifies that the redirect URI matches what was recorded with the code. This effectively allows full account takeover and unauthorized access to the victim's email. The flaw affects Stalwart Mail Server through version 0.16.19.