MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that all…

MaxKey through version 4.1.12 contains an insufficient redirect URI validation vulnerability in the DefaultRedirectResolver.hostMatches() method. The flaw allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a malicious authorization URL. This causes the authorization code to be issued to the attacker-controlled URI, which can then be exchanged for an access token. The access token grants the attacker access to the victim's identity. The vulnerability has been fixed in commit ddbb72f of the MaxKey repository.