Vulnerability Overview
ChatCLI versions 1.159.0 through 1.215.1 contain a high-severity origin validation error (CVE-2026-123271) in the Model Context Protocol (MCP) OAuth login flow. The vulnerability allows a malicious or compromised MCP server to obtain OAuth bearer tokens intended for other resources and replay them against those resources.
Technical Details
When a user logs in to a remote MCP server using the `/mcp login` command or the `@mcp-login` tool, ChatCLI accepted the `resource` member from the Protected Resource Metadata served by the MCP server without performing the identity check required by RFC 9728 section 3.3. The application used this server-supplied resource value as the RFC 8707 resource indicator in the authorization request, code exchange, stored OAuth metadata, and every token refresh.
A malicious MCP server could declare a different resource served by the same authorization server. After the user completed consent, ChatCLI would send the resulting token—audience-bound to that other resource—to the MCP server as its bearer credential. The server could then replay this token against the other resource.
Additional issues identified in the vulnerable code include:
- The `resource_metadata` URL from the server’s WWW-Authenticate challenge was followed on any origin
- Discovery documents were read without size limits
- The SSE transport accepted a messages endpoint on any origin and sent server credentials there
Exploitation Requirements
Successful exploitation requires several conditions:
- A malicious or compromised MCP server
- An authorization server that supports dynamic client registration and honors the requested resource indicator
- A second resource of that authorization server that accepts the token
- The user completing the consent flow
Affected Versions
ChatCLI versions 1.159.0 through 1.215.1 are affected by this vulnerability.
Patch Information
The vulnerability is fixed in ChatCLI version 1.215.2, released on October 11, 2026. The patch implements multiple security improvements:
- The canonical URL of the configured MCP server is now the only resource indicator used
- Protected resource metadata naming another resource is refused
- The `resource_metadata` URL is followed only on the server’s own origin
- Discovery and registration documents are capped at 1 MiB
- Credentials stored by affected versions for another resource are never sent and require a new login
- The SSE transport confines the messages endpoint to the server’s origin
- MCP transports refuse cross-origin and downgrading redirects
- Authorization server metadata must name its issuer per RFC 8414 section 3.3 and use HTTPS endpoints
Remediation Steps
Users should upgrade to ChatCLI version 1.215.2 immediately. After upgrading, users who logged in to an untrusted MCP server should:
1. Run `/mcp logout
2. Revoke the ChatCLI client at the authorization server
As a workaround for users unable to upgrade immediately, only log in to MCP servers that are trusted.
Credit
This vulnerability was reported by Theodoros Lampropoulos (@GimmyDatBeeR).
