Improper Validation Vulnerability in ChatCLI OAuth Login Flow

CVE-2026-123271

What is CVE-2026-123271?

ChatCLI versions before v1.215.2 are affected by an improper validation vulnerability within the MCP OAuth login flow. The vulnerability arises from the software using server-supplied Protected Resource Metadata as a resource indicator without properly validating that it corresponds to the configured server URL. This flaw enables a malicious MCP server to declare a different resource on the same authorization server. Consequently, the attacker could obtain the user's bearer token for that resource and potentially use this token against an unauthorized resource, leading to unauthorized access.

References