Maxkey
Monthly
OAuth 2.0 authorization-code theft in Dromara MaxKey through 4.1.12 lets remote attackers hijack a victim's authorization code and exchange it for an access token, taking over the victim's federated identity. The flaw lives in DefaultRedirectResolver.hostMatches(), where a naive endsWith() suffix comparison lets an attacker-controlled domain that ends with a registered redirect URI hostname pass validation. Publicly available exploit code exists and a vendor patch (commit ddbb72f) is available; no active exploitation has been confirmed (not in CISA KEV).
SQL injection in Dromara MaxKey up to version 3.5.13 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the filtersfields argument in the StrUtils.checkSqlInjection function, potentially leading to unauthorized data access, modification, or deletion. The vulnerability requires low-privilege authentication and has publicly available exploit code; the vendor has not responded to early disclosure notifications.
Server-side request forgery (SSRF) in Dromara MaxKey up to 4.1.7 allows authenticated attackers to make internal network requests via the Meta URL handler. A public exploit exists, but exploitation requires low privileges and no user interaction. EPSS score is low (0.11%), indicating limited active exploitation risk.
OAuth 2.0 authorization-code theft in Dromara MaxKey through 4.1.12 lets remote attackers hijack a victim's authorization code and exchange it for an access token, taking over the victim's federated identity. The flaw lives in DefaultRedirectResolver.hostMatches(), where a naive endsWith() suffix comparison lets an attacker-controlled domain that ends with a registered redirect URI hostname pass validation. Publicly available exploit code exists and a vendor patch (commit ddbb72f) is available; no active exploitation has been confirmed (not in CISA KEV).
SQL injection in Dromara MaxKey up to version 3.5.13 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the filtersfields argument in the StrUtils.checkSqlInjection function, potentially leading to unauthorized data access, modification, or deletion. The vulnerability requires low-privilege authentication and has publicly available exploit code; the vendor has not responded to early disclosure notifications.
Server-side request forgery (SSRF) in Dromara MaxKey up to 4.1.7 allows authenticated attackers to make internal network requests via the Meta URL handler. A public exploit exists, but exploitation requires low privileges and no user interaction. EPSS score is low (0.11%), indicating limited active exploitation risk.