Advisories · Technology

dromara MaxKey.

Every CVE that names dromara MaxKey among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-69102 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust
- dromara MaxKey
- Hard-coded credentials
Not analysed yet 11 Aug 2026
CVE-2026-67345 CVE record

CVSS 8.5 High

MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft
- dromara MaxKey
- CWE-183
Not analysed yet 30 Jul 2026
CVE-2026-7699 CVE record

CVSS 5.3 Medium

Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection
- Dromara MaxKey
- Other injection
- SQL injection
Not analysed yet 3 May 2026
CVE-2025-6517 CVE record

CVSS 5.3 Medium

Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery
- Dromara MaxKey
- Server-side request forgery (SSRF)
Not analysed yet 23 Jun 2025