ChatCLI (< 1.215.2)

ChatCLI versions prior to 1.215.2 are vulnerable to token theft and replay attacks because the application fails to validate Protected Resource Metadata during the MCP OAuth login flow.