Dromara Maxkey
4 CVEs affecting Dromara Maxkey. Latest disclosed: 2026-08-11. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-69102 | Critical | 9.8 | 2026-08-11 | MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attack… |
CVE-2026-67345 | High | 8.1 | 2026-07-30 | MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that al… |
CVE-2026-7699 | Medium | 6.3 | 2026-05-03 | A security flaw has been discovered in Dromara MaxKey up to 3.5.13. Affected by this issue is the function StrUtils.checkSqlInjection of the file StrUtils.java… |
CVE-2025-6517 | Medium | 6.3 | 2025-06-23 | A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\… |