CVE-2026-67345

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/dromara/MaxKey/commit/ddbb72fb24ab8e66aa422fb14b1177330bcffb45
https://github.com/dromara/MaxKey/issues/269
https://www.vulncheck.com/advisories/maxkey-defaultredirectresolver-oauth-authorization-code-theft

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) MaxKey hasta la versión 4.1.12, corregido en el commit ddbb72f, contiene una vulnerabilidad de validación insuficiente de URI de redirección en DefaultRedirectResolver.hostMatches() que permite a atacantes remotos secuestrar códigos de autorización de OAuth 2.0 al proporcionar una redirect_uri manipulada cuyo sufijo de nombre de host coincide con un URI registrado sin un anclaje de límite de punto adecuado. Los atacantes que controlan un dominio que termina con el nombre de host del URI de redirección registrado pueden engañar a las víctimas (mediante ingeniería social) para que hagan clic en una URL de autorización manipulada, lo que provoca que el código de autorización se emita al URI controlado por el atacante y se intercambie por un token de acceso que otorga acceso a la identidad de la víctima.

Information

Published : 2026-07-30 15:16

Updated : 2026-10-23 22:10

NVD link : CVE-2026-67345

Mitre link : CVE-2026-67345

CVE.ORG link : CVE-2026-67345

JSON object : View

Products Affected

No product.

CWE

CWE-183

Permissive List of Allowed Inputs

{"id": "CVE-2026-67345", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67345", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-30T17:28:57.453169Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/dromara/MaxKey", "vendor": "dromara", "product": "MaxKey", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.1.12"}, {"status": "unaffected", "version": "ddbb72fb24ab8e66aa422fb14b1177330bcffb45", "versionType": "git"}], "packageURL": "pkg:github/dromara/MaxKey", "defaultStatus": "unaffected"}]}], "published": "2026-07-30T15:16:35.583", "references": [{"url": "https://github.com/dromara/MaxKey/commit/ddbb72fb24ab8e66aa422fb14b1177330bcffb45", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/dromara/MaxKey/issues/269", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/maxkey-defaultredirectresolver-oauth-authorization-code-theft", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-183"}]}], "descriptions": [{"lang": "en", "value": "MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity."}, {"lang": "es", "value": "MaxKey hasta la versi\u00f3n 4.1.12, corregido en el commit ddbb72f, contiene una vulnerabilidad de validaci\u00f3n insuficiente de URI de redirecci\u00f3n en DefaultRedirectResolver.hostMatches() que permite a atacantes remotos secuestrar c\u00f3digos de autorizaci\u00f3n de OAuth 2.0 al proporcionar una redirect_uri manipulada cuyo sufijo de nombre de host coincide con un URI registrado sin un anclaje de l\u00edmite de punto adecuado. Los atacantes que controlan un dominio que termina con el nombre de host del URI de redirecci\u00f3n registrado pueden enga\u00f1ar a las v\u00edctimas (mediante ingenier\u00eda social) para que hagan clic en una URL de autorizaci\u00f3n manipulada, lo que provoca que el c\u00f3digo de autorizaci\u00f3n se emita al URI controlado por el atacante y se intercambie por un token de acceso que otorga acceso a la identidad de la v\u00edctima."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "disclosure@vulncheck.com"}