CVE-2026-123271: ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user's bearer token for it, and replay that token against the other resource.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ChatCLIto a version that resolves this vulnerability.Fixed in 1.215.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of ChatCLI versions before v1.215.2 are exposed when they use the MCP OAuth login flow with a malicious MCP server. The server must be able to use the same authorization server as another target resource.
What must an attacker do to exploit it?
An attacker needs to operate or control a malicious MCP server and cause a user to complete its OAuth login flow. The malicious server declares a different resource in its Protected Resource Metadata, causing ChatCLI to request a bearer token that can be replayed against that other resource.
Does exploitation require user interaction?
Yes. The provided vector identifies user interaction as required, and the attack depends on the user completing the OAuth login flow for the malicious MCP server.
What should be done to remediate the issue?
Upgrade ChatCLI to v1.215.2 or later. That release is identified as the fixed version.