Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation.
CVSS 4.0MEDIUM 6.0·Network·No auth·User interaction·EPSS 0.00159·Published 2026-10-05·Fixed in 0.12.1CWE-352