Chatcli Before 1.215.2 Origin Validation Error Via Unvalidated Mcp Oauth Resource Indicator

Back www.vulncheck.com

Chatcli Before 1.215.2 Origin Validation Error Via Unvalidated Mcp Oauth Resource Indicator

www.vulncheck.com • November 6, 2026

Share: View original

ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator

ChatCLI >= v1.159.0, = v1.159.0, < v1.215.2

CWE-346 Origin Validation Error

GitHub Security Advisory (GHSA-95vg-3r9c-2v5q)

ChatCLI v1.215.2 Release Notes

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Medium-Likelihood OAuth Vulnerability in ChatCLI Exposes Bearer Tokens ChatCLI versions before 1.215.2 contain a vulnerability (CVE-2026-123271) in the OAuth login flow that allows a malicious MCP server to exploit improper validation of resource metadata. This flaw can lead to unauthorized access by enabling an attacker to replay bearer tokens against different resources. The vulnerability affects developers and operators using MCP integrations, particularly when connecting to untrusted servers. The risk is classified as medium-likelihood with potentially high impact, but exploitation status remains unconfirmed. Users are advised to upgrade to the latest version or restrict connections to trusted servers. The vulnerability was published on November 5, 2026, with a CVSS score of 5.1. 1 sources 50

Extracted Entities

CWE Weaknesses (1)

CWE-346 - Origin Validation Error

Vulnerabilities (1)

Origin Validation Error