MaxKey EUVD-2026-51148

Requires that MaxKey is used as an OAuth 2.0 authorization-code (or implicit) provider with subdomain matching effectively enabled - DefaultRedirectResolver.matchSubdomains defaults to true, so this is the default behavior - and that at least one OAuth client is registered with a redirect URI whose hostname the attacker can suffix-match by registering/controlling a domain ending in that registered hostname (e.g. registered 'example.com' abused via 'attacker-example.com'). Exploitation is limited by UI:A: a victim with an active MaxKey session must be social-engineered into clicking the attacker's crafted authorization URL; no attacker authentication is needed (PR:N), but success depends on that user interaction and on a registered client whose redirect host is suffix-collidable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N, base 8.5 High) indicates a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact, but it explicitly requires active user interaction (UI:A) - the victim must click a crafted authorization URL. That user-interaction requirement is the main brake on real-world risk: this is a social-engineering-dependent account-takeover primitive, not a wormable server-side RCE. Publicly available exploit code raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation at this time - treat exploit availability and active exploitation as distinct signals. Net: a patch-now issue for any internet-facing MaxKey deployment used as an SSO broker (a successful attack yields full identity/session takeover), tempered by the product's relatively niche footprint and the phishing prerequisite.

An attacker registers a domain whose hostname ends with a victim tenant's registered redirect URI host (e.g. controlling 'goodexample.com' to abuse a registered 'example.com'), then crafts an OAuth authorization URL pointing MaxKey to that attacker-controlled redirect_uri and phishes a logged-in victim into clicking it. Because DefaultRedirectResolver accepts the suffix match, MaxKey issues the authorization code to the attacker's host, which exchanges it for an access token to impersonate the victim. Publicly available exploit code lowers the bar to reproduce this.