CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и след действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.
Засегнати продукти
- dromara MaxKey: до 4.1.12; ddbb72fb24ab8e66aa422fb14b1177330bcffb45
Вид слабост
История
- 30 юли 2026 Публикувано
Други уязвимости в dromara MaxKey
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-67345
- https://nvd.nist.gov/vuln/detail/CVE-2026-67345
- https://github.com/dromara/MaxKey/issues/269
- https://github.com/dromara/MaxKey/commit/ddbb72fb24ab8e66aa422fb14b1177330bcffb45
- https://www.vulncheck.com/advisories/maxkey-defaultredirectresolver-oauth-authorization-code-theft