Chaterm Login CSRF Vulnerability Before 0.12.1

Executive Summary

CVE-2026-105292 is a login cross-site request forgery (CSRF) vulnerability in Chaterm versions before 0.12.1. It occurs because the application fails to validate the OAuth state parameter in chaterm:// callbacks. Attackers can exploit this by sending a crafted callback with attacker-controlled user information from a web page, forcing victims to sign into the attacker's account without their knowledge. This leads to sensitive data like saved hosts, passwords, and private keys being uploaded to the attacker's account.

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-105292, check if Chaterm is running a version prior to 0.12.1. Use commands like 'chaterm --version' or inspect the application's version in installed files. Monitor network traffic for unexpected chaterm:// callbacks or OAuth state mismatches.

Useful 0 Not Useful 0

Impact Analysis

If you use Chaterm before version 0.12.1, an attacker could trick you into logging into their account via a malicious web page. This could result in your saved hosts, passwords, and private keys being synced to the attacker's account. The attacker gains access to your sensitive data without your direct involvement.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data such as saved hosts, passwords, and private keys, which may violate compliance requirements under GDPR (data protection) and HIPAA (privacy and security of health information). The lack of OAuth state validation allows attackers to manipulate login states, potentially exposing regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Chaterm to version 0.12.1 or later immediately. Ensure OAuth state validation is enabled by setting the environment variable RENDERER_OAUTH_DEEPLINK_SIGNATURE_ENABLED=true. Verify the public key oauth_deeplink_public_key.pem is present and correctly configured in the application.

Useful 0 Not Useful 0