CVE Alert: CVE-2026-123271 – diillson

ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user’s bearer token for it, and replay that token against the other resource.

**Risk verdict:** Treat this as a medium-likelihood, potentially high-impact credential exposure; exploitation status is unconfirmed because KEV, SSVC, PoC and EPSS data were not provided.

**Why this matters:** A successful attack could expose a bearer token usable against another resource, enabling unauthorised access or changes there. The practical risk depends on what that resource permits and whether the token remains valid; direct impact to the affected client is not indicated.

**Most likely attack path:** An attacker operates or compromises an MCP server that a user chooses to connect to, then supplies a misleading OAuth resource value during login. Network access is sufficient and no prior privileges are required, but the user must actively complete the flow; the trust boundary crossing creates potential impact on the other resource.

**Who is most exposed:** Developers and operators using MCP integrations in interactive CLI workflows are the main concern, especially where they connect to untrusted servers or use tokens with broad access.

Review MCP server additions and OAuth logins, particularly to unfamiliar endpoints.

Look for tokens issued for an unexpected resource or audience.

Check downstream resource audit logs for token use soon after an MCP login.

Alert on unusual write actions associated with affected user identities.

Mitigation and prioritisation:

Upgrade to the latest vendor-fixed release; confirm the deployed build is remediated.

Until upgraded, restrict MCP connections to trusted, allow-listed servers.

Revoke potentially exposed tokens and review their scopes and downstream use.

Roll out via normal change control, prioritising developer environments with broad-scope credentials.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.