Executive brief
MaxKey, an open-source single sign-on (SSO) system, contains a flaw in how it validates web addresses during the login process. An attacker can trick a user into clicking a malicious link that sends the user's login credentials (authorization codes) to a server controlled by the attacker. This allows the attacker to hijack the user's identity and gain unauthorized access to connected corporate applications and data.
Technical details
A vulnerability exists in the DefaultRedirectResolver.hostMatches() method of MaxKey due to the use of a suffix-based check (endsWith) without proper dot-boundary anchoring. When matchSubdomains is enabled (which is the default), the resolver validates requested redirect URIs by checking if the hostname ends with the registered hostname. An attacker can bypass this by using a domain they control that shares a suffix with the legitimate domain (e.g., 'attacker-target.com' matching 'target.com'). By social-engineering a victim into clicking a crafted OAuth 2.0 authorization URL, the attacker can intercept the authorization code and exchange it for an access token. The issue is fixed in commit ddbb72f by removing matchSubdomains and implicit grant types.
Affected products
- dromara MaxKey through 4.1.12
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory
- 2026-07-30: patched: Fixed in commit ddbb72f