EUVD-2025-18913Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to MaxKey management
-
DeliveryNavigate to SAML metadata URL handler
-
ExploitSubmit crafted POST with internal URL
-
ExecutionServer sends SSRF request to internal resource
-
ImpactAccess internal service or data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have low-privilege access to the MaxKey management interface (PR:L). No user interaction is required (UI:N). The attack is network-based (AV:N) with low complexity (AC:L) and no special attack requirements (AT:N). The vulnerability is triggered via the 'post' argument in the SAML20DetailsController's Add function. Limiting factor: exploitation requires authentication, so unauthenticated remote attackers cannot exploit this directly. |
| Impact | CVSS 4.0 base score is 2.1 (Low) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, indicating low impact on confidentiality, integrity, and availability. EPSS score is 0.11% (30th percentile), suggesting low exploitation probability. A public exploit is available, but no active exploitation has been reported (not in CISA KEV). The SSVC decision framework would likely rate this as 'Medium' priority due to automatable exploitation but low impact. Overall, this is a low-risk issue despite the public exploit. |
| Exploit ScenarioDerived | An authenticated attacker with low privileges sends a crafted POST request to the SAML metadata URL handler, specifying an internal IP address (e.g., http://192.168.1.1/admin). The server makes a request to that internal resource, potentially exposing sensitive data or allowing further attacks. A public exploit is available, simplifying exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Server-side request forgery (SSRF) in Dromara MaxKey up to 4.1.7 allows authenticated attackers to make internal network requests via the Meta URL handler. A public exploit exists, but exploitation requires low privileges and no user interaction. EPSS score is low (0.11%), indicating limited active exploitation risk.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch is available as the vendor did not respond. As a workaround, restrict access to the SAML metadata URL handler by implementing network-level controls (e.g., firewall rules to block outbound requests from the MaxKey server to internal networks) or disable the Meta URL feature if not required. Input validation should be added to sanitize URLs and prevent requests to private IP ranges. These mitigations may impact SSO functionality that relies on metadata imports.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a server-side request forgery (CWE-918) in the SAML20DetailsController.java file of MaxKey, an open-source single sign-on (SSO) system. The affected component is the Meta URL Handler, which processes user-supplied URLs without proper validation, enabling attackers to forge requests to internal systems. CPE data confirms all MaxKey versions up to 4.1.7 are affected.
Know when Maxkey gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
PR:L due to required authentication; no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\src\main\java\org\dromara\maxkey\web\apps\contorller\SAML20DetailsController.java of the component Meta URL Handler. The manipulation of the argument post leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using Dromara MaxKey should be aware of moderate risk from CVE-2025-6517, a server-side request forgery vulnerability rated CVSS 6.3. Users could be tricked into performing unintended actions. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement egress filtering, block metadata endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
OAuth 2.0 authorization-code theft in Dromara MaxKey through 4.1.12 lets remote attackers hijack a victim's authorizatio
SQL injection in Dromara MaxKey up to version 3.5.13 allows authenticated remote attackers to execute arbitrary SQL quer
Exploit-DB