CVE-2026-67345 affects dromara MaxKey through version 4.1.12. The vulnerability arises from insufficient validation of redirect URIs in the DefaultRedirectResolver.hostMatches() method. Specifically, the hostname suffix matching does not enforce proper dot-boundary anchoring, allowing an attacker who controls a domain with a hostname suffix matching a legitimate registered redirect URI to craft a malicious redirect_uri parameter. When a victim clicks on this crafted authorization URL, the OAuth 2.0 authorization code is issued to the attacker-controlled URI, enabling the attacker to exchange it for an access token and gain access to the victim's identity. This flaw compromises the OAuth 2.0 authorization flow's integrity.

An attacker can hijack OAuth 2.0 authorization codes by exploiting the insufficient redirect URI validation, potentially gaining unauthorized access to victim identities via access tokens. This undermines the security of the OAuth 2.0 authorization process in affected MaxKey versions, leading to high-severity risks of identity compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit ddbb72f, so upgrading to a version including this commit or later is recommended once available. Until then, avoid using vulnerable versions or apply any official fixes provided by the vendor.