CVE-2026-67345

Deferred Deferred - Pending Action

MaxKey OAuth 2.0 Redirect URI Validation Bypass

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted authorization URL, causing the authorization code to be issued to the attacker-controlled URI and exchanged for an access token granting access to the victim's identity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-67345

EUVD

EUVD-2026-51148

Affected Vendors & Products

Vendor	Product	Version / Range
maxkey	maxkey	to 4.1.12 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-183	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Attack-Flow Graph

Executive Summary

MaxKey through 4.1.12 has an insufficient redirect URI validation flaw in DefaultRedirectResolver.hostMatches(). Attackers can exploit this by crafting a redirect_uri with a hostname suffix matching a registered URI without proper dot-boundary checks. This allows them to hijack OAuth 2.0 authorization codes and redirect them to attacker-controlled domains.

Detection Guidance

Detecting this vulnerability requires checking if MaxKey versions before 4.1.12 are deployed and if OAuth 2.0 redirect URI validation is improperly configured. Review MaxKey logs for suspicious authorization code exchanges to unregistered URIs. Inspect network traffic for OAuth flows with mismatched redirect URIs.

Impact Analysis

If you use MaxKey for authentication, attackers could steal your OAuth 2.0 authorization codes. This could grant them access to your identity and sensitive data. Victims may unknowingly authorize access to their accounts via crafted URLs.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using MaxKey may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade MaxKey to the latest version (commit ddbb72f or later) to fix the redirect URI validation flaw. Review and update OAuth 2.0 redirect URI configurations to enforce strict hostname matching with dot-boundary anchoring. Monitor for unauthorized authorization code exchanges.

Hi! I’m here to help you understand CVE-2026-67345. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70