Is CVE-2026-67345 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67345 being exploited in the wild.

How severe is CVE-2026-67345?

High severity, with a CVSS score of 8.1, published 30 July 2026.

Is there a fix for CVE-2026-67345?

A patch was published on 2026-07-30: Fixed in commit ddbb72f Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67345 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-67345?

Check whether you run Dromara MaxKey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67345: MaxKey insufficient redirect URI validation in DefaultRedirectResolver

CVE-2026-67345 · Severity: high · CVSS 8.1 · Published 2026-07-30

MaxKey, an open-source single sign-on (SSO) system, contains a flaw in how it validates web addresses during the login process. An attacker can trick a user into clicking a malicious link that sends the user's login credentials (authorization codes) to a server controlled by the attacker. This allows the attacker to hijack the user's identity and gain unauthorized access to connected corporate applications and data.

Vendors: Dromara.

Quick answers

Is CVE-2026-67345 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67345 being exploited in the wild.
How severe is CVE-2026-67345?: High severity, with a CVSS score of 8.1, published 30 July 2026.
Which products and versions are affected?: Dromara MaxKey through 4.1.12.
Is there a fix for CVE-2026-67345?: A patch was published on 2026-07-30: Fixed in commit ddbb72f Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67345 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-67345?: Check whether you run Dromara MaxKey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the DefaultRedirectResolver.hostMatches() method of MaxKey due to the use of a suffix-based check (endsWith) without proper dot-boundary anchoring. When matchSubdomains is enabled (which is the default), the resolver validates requested redirect URIs by checking if the hostname ends with the registered hostname. An attacker can bypass this by using a domain they control that shares a suffix with the legitimate domain (e.g., 'attacker-target.com' matching 'target.com'). By social-engineering a victim into clicking a crafted OAuth 2.0 authorization URL, the attacker can intercept the authorization code and exchange it for an access token. The issue is fixed in commit ddbb72f by removing matchSubdomains and implicit grant types.

Affected products

dromara MaxKey through 4.1.12

Timeline

2026-07-30: disclosed
2026-07-30: advisory
2026-07-30: patched: Fixed in commit ddbb72f

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.