ChatCLI MCP OAuth login flaw leaks bearer token to another resource

A command-line chat tool can leak your logins to a malicious server.

Summary

ChatCLI's MCP OAuth login does not check the resource address that an MCP server supplies. A malicious MCP server can get a user's bearer token issued for, and replayed against, another resource; versions before v1.215.2 are affected.

Affected when

Logging in to a malicious or compromised MCP server with ChatCLI
Authorization server supports dynamic client registration and honours the requested resource indicator
A second resource on the same authorization server accepts the token
User completes consent

What to do

Update to 1.215.2 or later. Until then, log in only to MCP servers you trust. After upgrading, users who logged in to an untrusted MCP server should run /mcp logout <server> and revoke the ChatCLI client at the authorization server.

Products and platforms

ChatCLI

CVE IDs

CVE-2026-123271 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · github.com (opens in a new tab)
Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 18:45 UTC

First seen 2026-11-09 17:00 UTC