CVE-2026-105292 in Chaterm
Summary
by MITRE • 10/05/2026
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, passwords, and private keys.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Chaterm versions prior to 0.12.1 represents a critical authentication bypass mechanism rooted in improper validation of OAuth state parameters during the login callback process. This flaw allows remote attackers to execute cross-site request forgery attacks that effectively hijack user sessions by manipulating the identity verification flow. The core technical deficiency lies in the application's failure to validate the state parameter when processing incoming callbacks from external providers or custom URI schemes such as chaterm://. In standard OAuth 2.0 implementations, the state parameter is a crucial security control designed to prevent cross-site request forgery by ensuring that the authentication response corresponds to an initial request initiated by the legitimate user. By omitting this validation step, Chaterm inadvertently trusts any incoming callback payload regardless of its origin or integrity, thereby breaking the chain of trust required for secure session establishment.
From a technical perspective, the exploitation vector involves crafting a malicious web page that triggers a redirect to the chaterm:// URI scheme with attacker-controlled parameters embedded in the query string or fragment. When an authenticated victim clicks on this link or is redirected via other means such as phishing emails or compromised websites, their browser initiates the callback sequence. Because Chaterm does not verify that the state value matches what was originally generated and stored during the initial login initiation phase, it accepts the attacker-supplied user information as valid credentials. This allows the remote actor to inject a specific login state into the application context without possessing the victim's actual authentication tokens or passwords. The absence of cryptographic binding between the request initiator and the response handler is the fundamental flaw that enables this unauthorized access pattern.
The operational impact of this vulnerability is severe, extending beyond simple account takeover to include significant data integrity and confidentiality breaches. Once an attacker successfully triggers the crafted callback, they are signed into their own account using the victim's browser session context or vice versa depending on implementation specifics, but crucially, it allows the synchronization mechanism to upload sensitive default data associated with the compromised identity state. This includes saved hosts configuration files, stored passwords for remote systems, and private cryptographic keys used for secure communications. The exfiltration of these assets provides attackers with persistent access to internal networks and infrastructure, facilitating lateral movement within an organization's environment. Furthermore, because private keys are involved, the attacker can impersonate legitimate services or decrypt previously captured traffic if symmetric encryption is not employed elsewhere in the pipeline.
This vulnerability aligns closely with CWE-352, which describes Cross-Site Request Forgery (CSRF), specifically highlighting the lack of anti-CSRF tokens and state validation mechanisms. Additionally, it relates to CWE-613, Insufficient Session Expiration, as the session remains active under manipulated conditions without proper re-authentication checks. From an offensive security framework perspective, this technique maps to MITRE ATT&CK Tactic TA0004 (Privilege Escalation) and specifically Technique T1556.002, which covers Modifying OAuth Token Claims or State Parameters. The exploitation also touches upon T1078, Valid Accounts, as the attacker gains access using legitimate but misappropriated session contexts rather than creating new unauthorized accounts through brute force or credential stuffing.
Mitigation strategies must focus on implementing robust state validation within the OAuth callback handler. Developers should ensure that a unique, cryptographically secure random state value is generated at the start of the authentication flow and stored securely in the user's session data. Upon receiving the callback from the identity provider or custom URI scheme, the application must compare the returned state parameter against the one stored in the session. If they do not match exactly, the request should be rejected immediately with an appropriate error response indicating invalid state parameters. Additionally, implementing SameSite cookie attributes for all authentication-related cookies can provide a secondary layer of defense by preventing browsers from sending these cookies along with cross-site requests. Regular security audits and static code analysis focused on OAuth implementations are recommended to detect similar flaws in other parts of the application logic before they can be exploited in production environments.