Technical impact
MaxKey up to version 4.1.12 contains a flaw in DefaultRedirectResolver.hostMatches() that fails to apply dot‑boundary anchoring when validating redirect_uri hostnames. The vulnerability allows an attacker to craft a redirect URI whose hostname suffix matches a legitimate registered URI but points to a domain under the attacker’s control. When a victim authorizes such a link, the OAuth 2.0 authorization server issues a code to the attacker’s endpoint, which can then be exchanged for an access token and privileged identity data. This flaw demonstrates CWE‑183: Incorrect Comparison.
Affected Systems
Any installation of the dromara MaxKey identity server that includes the vulnerable DefaultRedirectResolver implementation and is running version 4.1.12 or earlier. The vulnerability applies to deployments that accept user‑supplied redirect_uri values during the OAuth 2.0 authorization flow.
Risk and Exploitability
The CVSS score of 8.5 indicates a high severity. Although the EPSS score is 0.0031 (<1%), indicating a very low current exploitation probability, the flaw permits a remote attack that requires only the ability to create a malicious authorization URL, which can be performed from any internet‑connected device. The vulnerability is not yet listed in CISA KEV but has an available fix and public disclosure. Attackers can exploit the weakness by social‑engineering victims into clicking a crafted URL; once the victim authorizes the request, the attacker receives an OAuth token that grants access to the victim’s identity, potentially leading to data exposure and unauthorized use of the victim’s credentials.
