Medium-Likelihood OAuth Vulnerability in ChatCLI Exposes Bearer Tokens

github.com

Medium-Likelihood OAuth Vulnerability in ChatCLI Exposes Bearer Tokens

First seen 6 Nov 2026, 13:15 UTC • •49.5

Article Content

1 / 5

Browse articles

ThreatCluster •November 6, 2026 at 13:16 UTC

•CVE-2026-123271 affects ChatCLI versions before 1.215.2.
•Vulnerability allows token replay via malicious MCP servers.
•Users should upgrade or restrict server connections to mitigate risk.

ChatCLI versions before 1.215.2 contain a vulnerability (CVE-2026-123271) in the OAuth login flow that allows a malicious MCP server to exploit improper validation of resource metadata. This flaw can lead to unauthorized access by enabling an attacker to replay bearer tokens against different resources. The vulnerability affects developers and operators using MCP integrations, particularly when connecting to untrusted servers. The risk is classified as medium-likelihood with potentially high impact, but exploitation status remains unconfirmed. Users are advised to upgrade to the latest version or restrict connections to trusted servers. The vulnerability was published on November 5, 2026, with a CVSS score of 5.1.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 3h ago How this analysis works

Timeline

2026-11-05

CVE-2026-123271 published

The vulnerability was disclosed with a CVSS score of 5.1, indicating medium severity.

Redpacketsecurity

2026-11-06

Advisory published on GitHub

GitHub advisory GHSA-95vg-3r9c-2v5q details the vulnerability and its implications for ChatCLI users.

More articles in this cluster (4)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Vulnerability (1)

CVE-2026-123271

Weakness (1)

CWE-287 - Improper Authentication

Relationships

CVE-2026-123271 related to Data Breach
CVE-2026-123271 related to CWE-287 - Improper Authentication

Following this threat?

Track CVE-2026-123271 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What versions of ChatCLI are affected?

ChatCLI versions prior to 1.215.2 are affected by this vulnerability.

What should I do to protect my systems?

Upgrade to the latest version of ChatCLI or restrict connections to trusted MCP servers.

Is there confirmed exploitation of this vulnerability?

No, the exploitation status is currently unconfirmed.

Continue Reading

Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…

China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…