CVE-2026-49357 PUBLISHED

Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

Assigner: GitHub_M
Reserved: 29.05.2026 Published: 19.06.2026 Updated: 19.06.2026

Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on Windows or Mac via MCP. line-desktop-mcp supports a --http-mode Streamable HTTP transport for use with clients such as n8n. In this mode the server binds to 0.0.0.0 and exposes the MCP /mcp endpoint without an MCP-layer authentication check. Prior to version 1.1.2, any network client that can reach the port can initialize a session, list tools, and call tools that read LINE Desktop chat history or send LINE messages through the already logged-in desktop application. Version 1.1.2 fixes the issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.8

Product Status

Vendor dtwang
Product line-desktop-mcp
Versions
  • Version < 1.1.2 is affected

References

Problem Types

  • CWE-306: Missing Authentication for Critical Function CWE
  • CWE-862: Missing Authorization CWE