CVE ID :CVE-2026-123271
Published : Nov. 5, 2026, 6:45 p.m. | 43 minutes ago
Description :ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user’s bearer token for it, and replay that token against the other resource.
Severity: 8.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more… To Read More Visit Read More