Chaterm CVE-2026-105292

Exploitation requires the victim to use the Chaterm desktop client (pre-0.12.1) with the chaterm:// custom URL-scheme handler registered, and to visit or interact with an attacker-controlled web page that triggers the deep-link callback - so success depends on victim interaction (UI:P) and the client reaching an exploitable callback/login state (AT:P, AC:H), not merely on a passive network position. The pre-fix client does not require or verify a signed callback or validate the OAuth state parameter, which is the core enabling condition; the patch introduces RSA-SHA256 signature verification (CHATERM_OAUTH_DEEPLINK_SIGNATURE_ENABLED) plus time-bound pending-state tracking. Meaningful impact (theft of secrets) further depends on the victim having default data sync enabled and having saved hosts, passwords, or private keys; a user with no stored credentials suffers only account-state injection.

This is a moderate-risk login CSRF (CWE-352) affecting the Chaterm desktop client, best characterized as a real-but-conditional threat rather than a mass-exploitation emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L) is internally consistent with the description: network-reachable via a malicious web page, but gated by high attack complexity (AC:H), a present attack requirement (AT:P - the client must be in or reach an exploitable login/callback state), and required victim interaction (UI:P). The standout signal is the high confidentiality impact (VC:H): a successful attack silently signs the victim into the ATTACKER's account, after which default data-sync uploads the victim's saved SSH hosts, passwords, and private keys to attacker-controlled storage - an unusually severe secondary impact for a CSRF. Mitigating the urgency: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit/POC is referenced, so there is no evidence of active or widespread exploitation. The 6.0 base score likely UNDERSTATES business impact for high-value users (sysadmins, DevOps) because the stolen material is credentials/keys, while OVERSTATING ease because AC:H+AT:P+UI:P require a chained social-engineering flow. Net: prioritize patching for teams whose engineers use Chaterm to store SSH secrets, but this is not a drop-everything internet-wide worm candidate.

An attacker hosts a web page that, when visited by a Chaterm user, invokes a crafted chaterm:// deep-link callback carrying attacker-controlled userInfo without a valid OAuth state value; because the pre-0.12.1 client fails to validate the state parameter, it accepts the forged login. The victim is silently authenticated into the attacker's account, and Chaterm's default data sync then uploads the victim's saved hosts, passwords, and private keys to the attacker's account. No public POC is referenced, though VulnCheck's advisory and the source-level fix (PR #2326) document the vulnerable callback handler.