CVE-2026-123271

ChatCLI MCP login can send another resource’s OAuth token to a hostile server

diillson · ChatCLI MCP OAuth client

First documented disclosure · Review checkpoint

Summary

A hostile MCP server can nominate a different protected resource and receive the user’s token for it.

Severity and exploitation evidence

Medium · 5.1/10 · CVSS 4.0. Severity source.

Exploitation not established: The maintainer advisory describes the vulnerability; no malicious exploitation or affected user is documented.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The client trusts server-supplied resource metadata across authorization, exchange, storage and refresh instead of binding the audience to the configured server.

Conditions required

The user completes login to a hostile server; its authorization server supports dynamic registration and the requested audience, and another resource accepts the resulting token.

Potential impact

The hostile server can replay the bearer token against that other resource, within the user’s granted permissions.

Affected versions and configurations

1.159.0 through versions before 1.215.2, according to the CNA.

Fix and mitigation status

1.215.2.

Practical next steps

Upgrade, log out of untrusted MCP servers and revoke the ChatCLI client grant at the authorization server.

Operating lesson

Bind token audiences to the intended server and invalidate stored credentials with a mismatched audience.

Evidence and limits

The release and advisory were public October 11; the CVE appeared November 5. VulnCheck rates CVSS 4.0 at 5.1 and CVSS 3.1 at 8.0; the displayed score uses 4.0.

Sources