AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-123271highSecret exposure2026-11-05

CVE-2026-123271: ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the r

ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL.

01.

What it is

ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user's bearer token for it, and replay that token against the other resource.

02.

How to check

  1. Compare your installed version with the range above (command below).
03.

How to fix

    04.

    Sources

    More advisories for this tool
    The weekly email

    One email a week. Only what changed.

    Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

    Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.