Which versions of MaxKey are affected by CVE-2025-6517?

Organizations using Dromara MaxKey should be aware of moderate risk from CVE-2025-6517, a server-side request forgery vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2025-6517?

Yes, a public proof-of-concept exploit is available for CVE-2025-6517. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6517?

Within 30 days: Identify affected systems running Dromara MaxKey and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

MaxKey CVE-2025-6517

Q: What is the CVSS score of CVE-2025-6517?

CVE-2025-6517 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18913 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2025-06-23 cna@vuldb.com

SSRF Java Maxkey

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

PR:L due to required authentication; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-18913

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

PoC Detected

Sep 30, 2025 - 18:19 vuln.today

Public exploit code

CVE Published

Jun 23, 2025 - 18:15 cve.org

LOW 2.1

CVE Published

Jun 23, 2025 - 18:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\src\main\java\org\dromara\maxkey\web\apps\contorller\SAML20DetailsController.java of the component Meta URL Handler. The manipulation of the argument post leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery (SSRF) in Dromara MaxKey up to 4.1.7 allows authenticated attackers to make internal network requests via the Meta URL handler. A public exploit exists, but exploitation requires low privileges and no user interaction. EPSS score is low (0.11%), indicating limited active exploitation risk.

Technical ContextAI

The vulnerability is a server-side request forgery (CWE-918) in the SAML20DetailsController.java file of MaxKey, an open-source single sign-on (SSO) system. The affected component is the Meta URL Handler, which processes user-supplied URLs without proper validation, enabling attackers to forge requests to internal systems. CPE data confirms all MaxKey versions up to 4.1.7 are affected.

RemediationAI

No vendor-released patch is available as the vendor did not respond. As a workaround, restrict access to the SAML metadata URL handler by implementing network-level controls (e.g., firewall rules to block outbound requests from the MaxKey server to internal networks) or disable the Meta URL feature if not required. Input validation should be added to sanitize URLs and prevent requests to private IP ranges. These mitigations may impact SSO functionality that relies on metadata imports.