An MCP OAuth resource indicator identifies the service for which a token is requested. In affected ChatCLI versions, metadata from a malicious or compromised MCP server could supply that identity instead of the client binding it to the server the user intended to connect. The advisory, published October 11, 2026, covers versions 1.159.0 through 1.215.1;…
Inspect the ClaimsCase · DiggingBeagle record
ChatCLI requested MCP OAuth tokens for an unvalidated resource
ChatCLI 1.159.0 through 1.215.1 trusted resource identity supplied through MCP metadata. Exploitation depended on a compatible authorization server, user authorization and another service accepting the resulting token.
Public disclosure: Oct 11, 2026
Scope
Vulnerability reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CHATCLI-RESOURCE-METADATA · ChatCLI MCP OAuth resource identity mix-up advisory
At a glance
The same identity-confusion pattern was found independently from mcp-go, but the ChatCLI implementation and patch are separate.
Read the implicationsNeeds an attacker-controlled discovery endpoint and authorization behavior; no confirmed user token theft in the wild.
Limits and uncertaintyFull account
An MCP OAuth resource indicator identifies the service for which a token is requested. In affected ChatCLI versions, metadata from a malicious or compromised MCP server could supply that identity instead of the client binding it to the server the user intended to connect. The advisory, published October 11, 2026, covers versions 1.159.0 through 1.215.1; 1.215.2 is patched.
The manipulated resource could propagate through authorization, token exchange, stored credentials and refresh. A token intended for another resource could then be sent to the malicious MCP endpoint and replayed. This requires compatible authorization-server behavior, a successful authorization interaction and a second resource that accepts the credential. It is not an unconditional token theft from any OAuth provider.
Repairing the binding
The patch derives the resource from the canonical MCP URL, constrains metadata origin and response size, and requires reauthorization for mismatched stored credentials. The advisory does not establish a customer's token being stolen in the wild.
A consent screen is not sufficient evidence of correct audience binding. The related mcp-go disclosure concerns a different implementation and discovery path; sharing the OAuth pattern does not make the two advisories one vulnerability.
Mechanism and trust boundary
- 01
A ChatCLI user connects to an attacker-selected MCP service through OAuth.
- 02
The service publishes an untrusted resource identity or discovery redirect; the client does not enforce the intended resource and origin binding.
- 03
The OAuth path can obtain or forward credentials for an unintended resource under a successful authorization interaction.
Claims & evidence
CLM-CHATCLI-RESOURCE-METADATAChatCLI 1.159.0 through 1.215.1 was affected by an MCP resource metadata binding issue, with same-origin and size controls added in 1.215.2.supported
Basis: reported finding
- supportsChatCLI MCP OAuth resource identity mix-up advisoryvendor statement
GHSA-95vg-3r9c-2v5q, Impact, Affected versions and Patched versions
Implications
The same identity-confusion pattern was found independently from mcp-go, but the ChatCLI implementation and patch are separate.
Controls and mitigations
- Upgrade to ChatCLI 1.215.2 and enforce origin, size and OAuth resource binding at each metadata redirect.
Unknowns and contradictions
- Needs an attacker-controlled discovery endpoint and authorization behavior; no confirmed user token theft in the wild.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233