CVE-2026-67345: MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirecturi whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MaxKey DefaultRedirectResolverto a version that resolves this vulnerability.Fixed in 4.1.12Patch ddbb72f
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67345?
CVE-2026-67345 has a severity rating of 8.5, indicating it is a high risk vulnerability.
How do I fix CVE-2026-67345?
To fix CVE-2026-67345, update to MaxKey version 4.1.13 or later, where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-67345?
CVE-2026-67345 is an insufficient redirect URI validation vulnerability that affects OAuth 2.0.
Who is affected by CVE-2026-67345?
Users of MaxKey versions up to 4.1.12 are affected by CVE-2026-67345.
What can attackers achieve with CVE-2026-67345?
Attackers can hijack OAuth 2.0 authorization codes using a crafted redirect URI that matches a registered hostname suffix.