EUVD-2026-51148
GHSA-7957-wqgw-m3j9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network attack (PR:N/AV:N) but needs a victim click (UI:R); the stolen token grants identity takeover on downstream resources (S:C, C:H/I:H) with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.
AnalysisAI
OAuth 2.0 authorization-code theft in Dromara MaxKey through 4.1.12 lets remote attackers hijack a victim's authorization code and exchange it for an access token, taking over the victim's federated identity. The flaw lives in DefaultRedirectResolver.hostMatches(), where a naive endsWith() suffix comparison lets an attacker-controlled domain that ends with a registered redirect URI hostname pass validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that MaxKey is used as an OAuth 2.0 authorization-code (or implicit) provider with subdomain matching effectively enabled - DefaultRedirectResolver.matchSubdomains defaults to true, so this is the default behavior - and that at least one OAuth client is registered with a redirect URI whose hostname the attacker can suffix-match by registering/controlling a domain ending in that registered hostname (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N, base 8.5 High) indicates a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact, but it explicitly requires active user interaction (UI:A) - the victim must click a crafted authorization URL. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a domain whose hostname ends with a victim tenant's registered redirect URI host (e.g. controlling 'goodexample.com' to abuse a registered 'example.com'), then crafts an OAuth authorization URL pointing MaxKey to that attacker-controlled redirect_uri and phishes a logged-in victim into clicking it. … |
| Remediation | Upstream fix available (commit ddbb72f); a released, tagged patched version is not independently confirmed from the provided data, so upgrade MaxKey to a build that includes commit ddbb72fb24ab8e66aa422fb14b1177330bcffb45 (or apply that patch, which removes the permissive matchSubdomains/endsWith suffix matching and drops the implicit grant type). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an asset inventory to determine whether your organization runs Dromara MaxKey and identify all federated systems and applications that depend on it for authentication. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery (SSRF) in Dromara MaxKey up to 4.1.7 allows authenticated attackers to make internal network
SQL injection in Dromara MaxKey up to version 3.5.13 allows authenticated remote attackers to execute arbitrary SQL quer
Same weakness CWE-183 – Permissive List of Allowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today