CVE-2026-67345 MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft
Attackers can hijack OAuth authorization codes via insufficient redirect URI validation, leading to account takeover and data access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-67345?
CVE-2026-67345 is a high-severity vulnerability in dromara MaxKey, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.
Weakness: CWE-183
Which versions are affected by CVE-2026-67345?
How do I fix CVE-2026-67345?
No fix has been published for CVE-2026-67345 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-67345 being exploited?
There is no known exploitation of CVE-2026-67345 in the wild and no public exploit code.
Sources
Also known as GHSA-7957-wqgw-m3j9.