CVE-2026-123271
ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator
CVSS Score
8.0
EPSS Score
0.0%
EPSS Percentile
0th
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user's bearer token for it, and replay that token against the other resource.
| CWE | CWE-346 |
| Vendor | diillson |
| Product | chatcli |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for diillson chatcli
Be the first to know when new high vulnerabilities affecting diillson chatcli are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
diillson / ChatCLI
v1.159.0 < v1.215.2
References
github.com: https://github.com/diillson/chatcli/security/advisories/GHSA-95vg-3r9c-2v5q github.com: https://github.com/diillson/chatcli/commit/951fe24b8e090eae86bf8edb13a788916b1e6c91 github.com: https://github.com/diillson/chatcli/releases/tag/v1.215.2 github.com: https://github.com/diillson/chatcli/blob/359eb27debc4de78289a9662551a51ab4528e16c/cli/mcp/oauth.go#L477-L493 vulncheck.com: https://www.vulncheck.com/advisories/chatcli-before-1.215.2-origin-validation-error-via-unvalidated-mcp-oauth-resource-indicator
Credits
Theodoros Lampropoulos diillson