CVE-2026-67345: dromara maxkey Permissive List of Allowed Inputs

Vulnerability summary

CVE-2026-67345 is a high (CVSS 8.5) Permissive List of Allowed Inputs vulnerability in dromara maxkey. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-07-2026
   PublishedVulnerability first disclosed.
2. 14-08-2026
   Last modifiedVulnerability information updated.

Description

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.

• CWE-183Permissive List of Allowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.