MaxKey through version 4.1.12 has an insufficient redirect URI validation vulnerability in the DefaultRedirectResolver.hostMatches() function. The validation fails to enforce proper dot-boundary anchoring on hostname suffixes, enabling attackers who control a domain ending with the registered redirect URI hostname to craft authorization URLs that cause OAuth 2.0 authorization codes to be issued to attacker-controlled URIs. This allows attackers to exchange the authorization code for access tokens, potentially compromising victim identities. The vulnerability was fixed in a commit identified as ddbb72f, which is after version 4.1.12.

An attacker who controls a domain with a hostname suffix matching a registered redirect URI can trick victims into clicking a crafted authorization URL. This results in the OAuth 2.0 authorization code being issued to the attacker-controlled URI. The attacker can then exchange the authorization code for an access token, gaining unauthorized access to the victim's identity information. This compromises the confidentiality and integrity of user authentication and authorization processes.

A fix for this vulnerability is available in a commit identified as ddbb72f, which addresses the insufficient redirect URI validation. Users should upgrade to a version of MaxKey that includes this fix. Since the affected versions are up to and including 4.1.12, upgrading to any version after 4.1.12 that contains the fix is recommended. Patch status is not explicitly confirmed in the advisory, so users should verify the vendor's official release notes or advisories for the fixed version.