CVE-2026-123271 in ChatCLI
Summary
by MITRE • 11/05/2026
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user's bearer token for it, and replay that token against the other resource.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in ChatCLI prior to version 1.215.2 represents a critical flaw within its Model Context Protocol OAuth authentication implementation, specifically concerning how the client handles server-supplied metadata during the login flow. This issue stems from an improper validation mechanism where the application accepts and utilizes Protected Resource Metadata provided by the MCP server as the resource indicator without performing sufficient verification against the originally configured or expected server URL. In a standard OAuth 2.0 authorization code grant flow, particularly when utilizing extensions like those defined in the Model Context Protocol, clients are responsible for ensuring that tokens obtained from an authorization server are scoped correctly to prevent unauthorized access to unintended resources. The failure here lies in the client's trust of external metadata inputs without cross-referencing them against a known good baseline or configuration, thereby creating a path for token confusion attacks.
From a technical perspective, this flaw allows a malicious MCP server to manipulate the authentication process by declaring a different resource identifier within its Protected Resource Metadata response. When ChatCLI processes this information, it assumes the declared resource is valid and proceeds to request an access token from the authorization server specifically scoped to that manipulated resource indicator rather than the intended service endpoint. Because OAuth tokens are often issued with specific audience or scope claims tied to the requested resource, a token obtained for one resource may be accepted by another if the receiving party does not strictly validate the token's intended audience against its own identity. This creates a scenario where the attacker can obtain a valid bearer token that is technically legitimate within the OAuth ecosystem but was issued under false pretenses regarding the target service.
The operational impact of this vulnerability is significant, as it enables an unauthorized replay attack across different resources hosted on the same authorization server. Once the malicious MCP server has secured the user's bearer token for the alternate resource through this deception, the attacker can use that token to authenticate against the other resource. This effectively bypasses access controls intended to isolate services from one another, potentially granting the attacker elevated privileges or access to sensitive data associated with the second resource. The severity is compounded by the fact that users may not be aware they are authenticating for a different service than expected, leading to potential data exfiltration, privilege escalation, or unauthorized actions performed under the user's identity on systems that should have remained isolated from the initial MCP interaction.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials in a broader sense regarding trust boundaries, as it involves failing to validate external input against expected values. In terms of offensive security frameworks, this behavior is characteristic of ATT&CK technique T1556.004 OAuth Token Theft or more specifically relates to token confusion attacks where the client fails to enforce strict binding between the authorization server's issued tokens and the intended resource identifiers. Such flaws are particularly dangerous in modern API-driven architectures where microservices rely on shared identity providers, as a breach in one service can cascade into others if proper audience validation is not enforced at every hop.
To mitigate this risk, developers must implement rigorous validation of all metadata received from external servers during authentication flows. Specifically, the resource indicator used to request tokens should be derived from local configuration or trusted sources rather than relying solely on server-supplied data without verification. It is essential to ensure that the audience claim in the issued token matches the expected service identifier before accepting it for use. Upgrading ChatCLI to version 1.215.2 or later resolves this issue by correcting the validation logic to properly check that the resource indicator aligns with the configured server URL, thereby preventing malicious servers from tricking clients into obtaining tokens for unintended resources. Organizations relying on earlier versions should immediately apply patches and review their MCP integrations to ensure no sensitive data was exposed during the window of vulnerability.