Improper OAuth Validation in ChatCLI MCP Login Flow

Executive Summary

ChatCLI before v1.215.2 has an improper validation flaw in its MCP OAuth login flow. It uses server-supplied Protected Resource Metadata as the resource indicator without verifying it matches the configured server URL. A malicious MCP server can declare a different resource on the same authorization server, obtain the user's bearer token for that resource, and replay the token against another resource.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if ChatCLI versions before v1.215.2 are installed. Run 'chatcli --version' to verify the version. If the version is below 1.215.2, the system is vulnerable. Additionally, inspect OAuth token bindings by reviewing stored credentials and checking if tokens are bound to unexpected resources.

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable version of ChatCLI with a malicious or compromised MCP server, an attacker could intercept your OAuth token and use it to access other resources or services where you have permissions. This could lead to unauthorized data access, privilege escalation, or token replay attacks against systems relying on the same authorization server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, which is a direct violation of data protection principles in GDPR and HIPAA. It undermines access controls and could lead to data breaches, resulting in regulatory penalties, loss of trust, and potential legal consequences for organizations handling protected data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ChatCLI to v1.215.2 or later immediately. Revoke any OAuth tokens issued to untrusted MCP servers. Avoid logging into untrusted MCP servers until upgraded. Review and remove stored credentials for affected resources. Monitor for unauthorized access or token replay attempts.

Useful 0 Not Useful 0