Multiple Vulnerabilities in Dromara MaxKey, mingSoft MCMS, and OpenAuth.Net

Public technical disclosures and proof-of-concept reproduction steps have been released for four CVEs affecting Dromara MaxKey, mingSoft MCMS, and OpenAuth.Net. The vulnerabilities include reflected and stored XSS, unauthenticated password modification, and sensitive information disclosure. A complete unauthenticated takeover chain was identified for OpenAuth.Net, potentially leading to RCE through an additional unauthenticated file upload capability.

Attack Chain (OpenAuth.Net)

1. Attacker calls /api/dynamic/GetList (CVE-2026-78832) without authentication to dump the SysUser table.
2. Attacker retrieves plaintext administrative credentials from the dumped user data.
3. Attacker uses obtained credentials or the /api/dynamic/Invoke endpoint (CVE-2026-78831) to perform unauthorized password changes.
4. Attacker accesses the administrative interface using the compromised account.
5. Attacker interacts with the unauthenticated /api/Files/Upload endpoint.
6. Attacker uploads a malicious file to achieve remote code execution.
7. Attacker optionally calls /api/dynamic/Delete to remove audit logs for anti-forensics.

Impact

• Dromara MaxKey 4.x: Reflected XSS enables admin session or JWT theft.
• mingSoft MCMS 6.1.1: Stored XSS allows malicious script injection via file uploads.
• OpenAuth.Net <= 8.3.4: Critical exposure allows full unauthenticated system takeover, data exfiltration, and arbitrary code execution.

Recommendation

• Upgrade Dromara MaxKey, mingSoft MCMS, and OpenAuth.Net to versions addressing these vulnerabilities immediately.
• For OpenAuth.Net, enforce strict authentication and authorization checks on all /api/dynamic/* and /api/Files/Upload endpoints.
• Inspect web server logs for high volumes of requests to the /api/dynamic/ path and unknown file uploads to /api/Files/Upload.
• Validate that no unauthorized users have been created or modified via administrative API endpoints.