Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

chaterm before 0.12.1 can log users into attacker account

CVE-2026-105292 · published 1 month ago
Summary

If a user visits a malicious web page, it can force the chaterm application to sign in with an attacker‑controlled account. This lets the attacker access the victim’s synchronized hosts, passwords and private keys. Upgrade chaterm to version 0.12.1 or later to stop this behavior.

What to do
  • Update chaterm chaterm to version 0.12.1 or later.
Affected software
VendorProductAffected versions
chaterm chaterm < 0.12.1
Original advisory text
Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, passwords, and private keys.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published5 Oct 2026
Updated26 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-105292 · NVD
CVE-2026-105292 · MITRE
CVE-2026-105292 · OSV
Track software like this
Free during beta