A permissive input validation flaw in MaxKey versions up to 4.1.12 allows unauthorized actors to perform OAuth authorization code theft, posing a high risk to user authentication integrity.

The vulnerability involves a permissive list of allowed inputs (CWE-183) in the DefaultRedirectResolver. This flaw permits an attacker to manipulate redirects and facilitate the theft of OAuth authorization codes.

Successful exploitation allows an attacker to bypass standard authentication flows and hijack user sessions, leading to unauthorized access to protected resources. With a CVSS score of 8.1, the risk of session takeover is substantial, potentially resulting in significant data exposure or identity compromise across the enterprise.

Immediate Action: Upgrade MaxKey to a version incorporating the fixes found in commit ddbb72fb24ab8e66aa422fb14b1177330bcffb45.

Proactive Monitoring: Review OAuth callback logs for anomalous redirect patterns or suspicious destination domains.

Compensating Controls: Utilize a Web Application Firewall to restrict redirect parameters and validate incoming request headers against a strict allowlist.

Public Exploit Available: No (unknown)

Administrators must verify their current MaxKey version and apply the recommended update immediately. Protecting the OAuth flow is critical to maintaining the trust and security of the identity provider infrastructure.