CVE-2026-123271

Name of the Vulnerable Software and Affected Versions ChatCLI versions prior to 1.215.2

Description An improper validation issue exists in the MCP OAuth login flow. The system uses server-supplied Protected Resource Metadata as the resource indicator without verifying that it matches the configured server URL. This allows a malicious MCP server to declare a different resource on the same authorization server, obtain the user's bearer token for that resource, and subsequently replay the token against it.

Recommendations Update ChatCLI to version 1.215.2 or later.