MaxKey vulnerabilities

3 known vulnerabilities in MaxKey from Dromara. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  MaxKey: Use of Hard-coded Credentials

  CVE-2026-69102Aug 11, 2026Dromara

  MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login e

• 8.1 High severity

  MaxKey: Permissive List of Allowed Inputs

  CVE-2026-67345Jul 30, 2026Dromara

  MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri who

• 9.8 Critical severity

  MaxKey: Server-Side Request Forgery

  CVE-2025-6517Jun 23, 2025Dromara

  A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\src\main\java\org\dromara\maxkey\web\apps\contorller\SAML20DetailsController.java of the component Me