Roundcube's OAuth2 code assumes that if oauth authentication is in
place, the same scheme will apply to the SMTP credentials, but this
is wrong: it's common that Roundcube will be installed in a host
that simply has a smtp forwarder to a smarthost, and thus no
authentication is needed.

Upstream fixed this in https://github.com/roundcube/roundcubemail/commit/504cdb89a5ed2c0c3491f99abb206dfb42b1200b
and the patch applies well to the bookworm branch.

Would it be possible to add this fix in a future point release? For your
convenience, here's a MR with the patch included:

https://salsa.debian.org/roundcube-team/roundcube/-/merge_requests/1

Jordi

That branch aims at following upstream's 1.6.x so I'm reluctant to
backport upstream changes from master.   AFAICT upstream hasn't applied
the change to their release-1.6 branch.  Could you please ask them to do
that first?