CVE-2026-105292
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, passwords, and private keys.
- Published Oct 5, 2026
- CVSS 6.0 medium
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available