CVE-2026-67345

HighCVSS 8.1

Published: 30/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

A vulnerability in MaxKey through version 4.1.12 (fixed in commit ddbb72f) involves insufficient redirect URI validation in DefaultRedirectResolver.hostMatches(), allowing remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring.

Risk Assessment

An attacker controlling a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.

Recommendation

It is recommended to update MaxKey to a version containing the fix (commit ddbb72f) and implement strict redirect_uri validation with domain boundaries.

Other vulnerabilities in MaxKey

CVE-2026-69102Critical
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.

Original NVD description (English source)

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.