CVE-2026-105292: Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, passwords, and private keys.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running Chaterm versions before 0.12.1 are exposed if they can be induced to open a crafted chaterm:// OAuth callback from a web page. No attacker privileges are required, but user interaction is required.
What can an attacker gain by exploiting the login CSRF?
An attacker can cause the victim to be signed in to an attacker-controlled account. Because data sync is enabled by default, the victim's saved hosts, passwords, and private keys may then be uploaded to that account.
Is the default configuration affected?
Yes. The described impact relies on default data synchronization, which uploads saved hosts, passwords, and private keys after the victim is signed into the attacker-controlled account.
What version resolves the issue?
Upgrade Chaterm to version 0.12.1 or later. The vulnerability affects versions before 0.12.1.