CVE-2026-105292 — Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth …
Published: 2026-10-05 · CVSS: 6.0 · CVSS 4.0
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, passwords, and private keys.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7