TI-2026-85605 CVE-2026-123271 · GHSA-2gm2-hpg7-78f2
Origin validation flaw in ChatCLI MCP OAuth login exposes tokens
Priority LOW 22
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured…