https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-07T06:53:45.118789+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-123271 fkie_cve-2026-123271 2026-11-07T06:53:45.120038+00:00

ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user's bearer token for it, and replay that token against the other resource.

 https://db.gcve.eu/vuln/ghsa-2gm2-hpg7-78f2 GHSA-2gm2-hpg7-78f2 2026-11-07T06:53:45.120097+00:00

ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user's bearer token for it, and replay that token against the other resource.