https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 07 Nov 2026 06:53:45 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-123271 <p>ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user&#39;s bearer token for it, and replay that token against the other resource.</p> <p>ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user&#39;s bearer token for it, and replay that token against the other resource.</p> https://db.gcve.eu/vuln/fkie_cve-2026-123271 https://db.gcve.eu/vuln/ghsa-2gm2-hpg7-78f2 <p>ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user&#39;s bearer token for it, and replay that token against the other resource.</p> <p>ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user&#39;s bearer token for it, and replay that token against the other resource.</p> https://db.gcve.eu/vuln/ghsa-2gm2-hpg7-78f2