GHSA-95vg-3r9c-2v5q: ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user's bearer token for it, and replay that token against the other resource.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ChatCLIto a version that resolves this vulnerability.Fixed in 1.215.2
Event History
Frequently Asked Questions
Which deployments are exposed?
ChatCLI versions before v1.215.2 are affected when users perform the MCP OAuth login flow with an MCP server. The issue depends on a malicious MCP server supplying Protected Resource Metadata that names a different resource using the same authorization server.
What must an attacker do to exploit this issue?
An attacker needs to operate or control a malicious MCP server and induce a user to complete its OAuth login flow. The server can declare another resource on the same authorization server, receive the user's bearer token for that resource, and replay it against that other resource.
What is the immediate mitigation if updating is not possible?
Avoid completing MCP OAuth login flows against untrusted MCP servers. Restrict MCP connections to servers you trust until ChatCLI can be updated to v1.215.2 or later.