Threats affecting pkg:golang/ChatCLI

ChatCLI versions before 1.215.2 have an origin validation vulnerability in the MCP OAuth login flow. The flaw involves improper validation of server-supplied Protected Resource Metadata, allowing a malicious MCP server to misuse bearer tokens by declaring unauthorized resources on the same authorization server. This can lead to token replay attacks against unintended resources.