CVE-2025-6517 is a medium severity (CVSS 6.3) server-side request forgery in Dromara MaxKey, an identity management and single sign-on product, up to version 4.1.7. The flaw is in the SAML metadata URL handler. The record says the vendor did not respond and lists no fix, so limit access and egress.
What's affected
MaxKey up to and including version 4.1.7. The affected code is the Add function in SAML20DetailsController.java, in the management web module, where a Meta URL handler fetches a URL supplied by the caller.
The record gives CVSS 3.1 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so the attack is over the network and needs a low privilege account. The record states that the exploit has been disclosed publicly and may be used, and that the vendor was contacted early but did not respond in any way. It does not name a fixed version.
The public write-up I fetched describes two server-side request forgery issues in MaxKey APIs, and says the issue was found by an automated code audit tool. I rely on the record for the version and severity. Check the project's repository for any fix before you conclude there is none.
How to check if you're exposed
Find the MaxKey version you run. The version is in the build artifacts or the admin console. Anything up to 4.1.7 is in scope.
Then review who can log in to the management application. The attack needs a login, so a long list of administrators or weak admin passwords raises the risk. Check that the management console is not reachable from the internet.
Check your outbound controls. Server-side request forgery turns the server into a proxy, so look at what the MaxKey host can reach. Cloud metadata services, internal admin pages and databases are the usual concerns.
What to do now
- Check the project repository and release notes for a fix, and upgrade if one exists.
- Restrict the management console to a trusted network or VPN.
- Limit outbound connections from the MaxKey host to the destinations it genuinely needs. Block access to cloud metadata addresses and internal services.
- Review the accounts that can manage SAML applications, and remove those that are not needed.
- Monitor logs for metadata URL requests that point at internal addresses.
Why it matters
Server-side request forgery (CWE-918) lets a user make the server send requests on their behalf. The server sits inside your network, so it can reach places the user cannot. In an identity product, that is sensitive, since the system holds the keys to many other applications.
The score is medium because a login is required and impact ratings are low. Do not take that to mean the product can wait. An identity provider is a high value target, and the record says there is no vendor response. The record does not say it was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Quick check
Is there a fixed version of MaxKey?
The record names none and says the vendor did not respond. Check the project repository for a newer release.
Why is it only medium?
The attack needs a low privilege login and the record rates the impacts low. In an identity product the real risk can be higher, depending on what the server can reach.
Sources
Last reviewed: 18 October 2026.
