The split you’re seeing lines up with how the two paths validate. IMAP and SMTP authenticate by binding to LDAP directly, so they succeed as soon as the bind works. The web UI login goes through the OAuth token flow, which additionally needs Stalwart to hold a password credential for the account; if the account was synced without a secret, that step fails with exactly this message even though the bind is fine.
So the likely cause is that the failing subtree’s entries don’t expose the password to Stalwart’s attrSecret mapping the same way the working ones do (a different objectClass or attribute, or a bind-only setup), so those accounts are materialised with an empty secret. Could you post your directory config (the filter/bind settings and the attrSecret / userPassword mapping, redacted) and note whether the two account types differ in schema? A debug-level auth trace for one failing web login would confirm it. Directory attribute docs are at LDAP Server | Stalwart .