Search

Find a vulnerability

Search criteria

    2 vulnerabilities by diillson

    CVE-2026-123271 (GCVE-0-2026-123271)

    Vulnerability from nvd – Published: 2026-11-05 18:45 – Updated: 2026-11-05 18:45
    VLAI
    Title
    ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator
    Summary
    ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user's bearer token for it, and replay that token against the other resource.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
    8 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
    CWE
    • CWE-346 - Origin Validation Error
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7427 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    diillson ChatCLI Affected: v1.159.0 , < v1.215.2 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-11 00:00
    Credits
    Theodoros Lampropoulos diillson
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/diillson/chatcli",
          "product": "ChatCLI",
          "repo": "https://github.com/diillson/chatcli",
          "vendor": "diillson",
          "versions": [
            {
              "lessThan": "v1.215.2",
              "status": "affected",
              "version": "v1.159.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Theodoros Lampropoulos"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "diillson"
        }
      ],
      "datePublic": "2026-10-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user\u0027s bearer token for it, and replay that token against the other resource."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T18:45:35.481Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-95vg-3r9c-2v5q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/diillson/chatcli/security/advisories/GHSA-95vg-3r9c-2v5q"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/diillson/chatcli/commit/951fe24b8e090eae86bf8edb13a788916b1e6c91"
        },
        {
          "name": "ChatCLI v1.215.2 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/diillson/chatcli/releases/tag/v1.215.2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/diillson/chatcli/blob/359eb27debc4de78289a9662551a51ab4528e16c/cli/mcp/oauth.go#L477-L493"
        },
        {
          "name": "VulnCheck Advisory: ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/chatcli-before-1.215.2-origin-validation-error-via-unvalidated-mcp-oauth-resource-indicator"
        }
      ],
      "title": "ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123271",
    "datePublished": "2026-11-05T18:45:35.481Z",
    "dateReserved": "2026-11-05T18:19:12.338Z",
    "dateUpdated": "2026-11-05T18:45:35.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-123271 (GCVE-0-2026-123271)

    Vulnerability from cvelistv5 – Published: 2026-11-05 18:45 – Updated: 2026-11-05 18:45
    VLAI
    Title
    ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator
    Summary
    ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user's bearer token for it, and replay that token against the other resource.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
    8 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
    CWE
    • CWE-346 - Origin Validation Error
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7427 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    diillson ChatCLI Affected: v1.159.0 , < v1.215.2 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-11 00:00
    Credits
    Theodoros Lampropoulos diillson
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/diillson/chatcli",
          "product": "ChatCLI",
          "repo": "https://github.com/diillson/chatcli",
          "vendor": "diillson",
          "versions": [
            {
              "lessThan": "v1.215.2",
              "status": "affected",
              "version": "v1.159.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Theodoros Lampropoulos"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "diillson"
        }
      ],
      "datePublic": "2026-10-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another resource on the same authorization server, obtain the user\u0027s bearer token for it, and replay that token against the other resource."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T18:45:35.481Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-95vg-3r9c-2v5q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/diillson/chatcli/security/advisories/GHSA-95vg-3r9c-2v5q"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/diillson/chatcli/commit/951fe24b8e090eae86bf8edb13a788916b1e6c91"
        },
        {
          "name": "ChatCLI v1.215.2 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/diillson/chatcli/releases/tag/v1.215.2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/diillson/chatcli/blob/359eb27debc4de78289a9662551a51ab4528e16c/cli/mcp/oauth.go#L477-L493"
        },
        {
          "name": "VulnCheck Advisory: ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/chatcli-before-1.215.2-origin-validation-error-via-unvalidated-mcp-oauth-resource-indicator"
        }
      ],
      "title": "ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123271",
    "datePublished": "2026-11-05T18:45:35.481Z",
    "dateReserved": "2026-11-05T18:19:12.338Z",
    "dateUpdated": "2026-11-05T18:45:35.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}