Vulnerability · Published Jul 30, 2026 · Assigned by VulnCheck

CVE-2026-67345MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft

High 8.1

In plain English

A high-severity security flaw in MaxKey from dromara. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.6%top 52.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.

Affected products (as reported)

Vendor	Product	Versions
dromara	MaxKey	0 – through 4.1.12

Weakness: CWE-183 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Researcher Disclosure technical-description, exploit, issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/maxkey-defaultredirectresolver-oauth-authorization-code-theft third-party-advisory