CVE-2026-67345 dromara CVE debrief

Who should care

Defenders responsible for MaxKey deployments, OAuth 2.0 authorization code management, and identity security should assess exposure and implement compensating controls to prevent OAuth 2.0 authorization code hijacking.

Why it matters

CVE-2026-67345 is an insufficient redirect URI validation vulnerability in MaxKey that allows remote attackers to hijack OAuth 2.0 authorization codes. Defenders should prioritize verifying and updating MaxKey, assessing exposure, and implementing compensating controls.

• Potential OAuth 2.0 authorization code hijacking
• Possible unauthorized access to victim's identity
• Need for verification of MaxKey version and exposure
• Priority for updating MaxKey to the fixed version

Technical summary

The vulnerability in MaxKey allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. This issue was fixed in commit ddbb72f. The vulnerability has a CVSS score of 8.5 and is considered HIGH severity. Defenders should prioritize verifying and updating MaxKey to the fixed version, assessing exposure, and implementing compensating controls to prevent OAuth 2.0 authorization code hijacking. The vulnerability affects MaxKey through version 4.1.12.

Defensive priority

Defenders should prioritize verifying and updating MaxKey to the fixed version, assessing exposure, and implementing compensating controls to prevent OAuth 2.0 authorization code hijacking.

Recommended defensive actions

• Verify and update MaxKey to the fixed version
• Assess exposure and implement compensating controls
• Monitor for suspicious OAuth 2.0 authorization code requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score of 8.5, and references to source-specific vulnerability assessments. The vulnerability allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. The issue was fixed in commit ddbb72f. Defenders should verify and update MaxKey to the fixed version, assess exposure, and implement compensating controls. The N

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.