{"id":"CVE-2026-105292","title":"Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation","summary":"Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback w…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","cwe":["CWE-352"],"vendor":"chaterm","product":"Chaterm","affected":["Chaterm >= 0.2.0 < 0.12.1"],"published":"2026-10-05","updated":"2026-10-05","sourceUpdated":"2026-10-05T01:16:28.630","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105292","references":[{"url":"https://github.com/Chaterm/Chaterm","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Chaterm/Chaterm/blob/v0.12.0/src/main/index.ts#L3442-L3455","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Chaterm/Chaterm/commit/41f747f17845cd980f289cc9ea8ff9978b6f7ad6","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Chaterm/Chaterm/pull/2326","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Chaterm/Chaterm/releases/tag/v0.12.1","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/chaterm-before-0.12.1-login-csrf-via-chaterm-oauth-callback","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-05T01:08:41.784Z","slug":"CVE-2026-105292","body":"## Overview\n\nChaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, passwords, and private keys.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}