8.5
Élevée
CVE-2026-67345 MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in…
Description
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MaxKey 4.1 | premières → 4.1.12 | Pas de correctif indiqué |
Autres CVE de MaxKey
Les 4 CVE de MaxKey →
CVE-2026-69102
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in…
9.3
Critique
CVE-2026-7699
A security flaw has been discovered in Dromara MaxKey up to 3.5.13
5.3
Moyenne
CVE-2025-6517
A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical
5.3
Moyenne