Is there a public PoC exploit available for CVE-2026-13524?

Yes, a public proof-of-concept exploit is available for CVE-2026-13524. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-13524?

Yes, a patch is available for CVE-2026-13524. Update the affected software to the latest version immediately.

Cherry Studio CVE-2026-13524

Q: What is the CVSS score of CVE-2026-13524?

CVE-2026-13524 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40021 LOW

Improper Authorization (CWE-285)

2026-06-29 VulDB

GHSA-9c5h-h4mj-p5ch

Authentication Bypass Cherry Studio Cherryhq

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Network vector per CVE description and CVSS 4.0 input; AC:H for race-condition timing requirement; PR:N as no credentials needed; no availability impact from code injection.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 03:22 NVD

6.3 (MEDIUM) 2.9 (LOW)

Source Code Evidence Fetched

Jun 29, 2026 - 02:46 vuln.today

Analysis Generated

Jun 29, 2026 - 02:46 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in CherryHQ cherry-studio up to 1.9.6. This vulnerability affects unknown code of the file src/main/services/mcp/oauth/callback.ts of the component MCP OAuth Local Callback Server. The manipulation of the argument code leads to improper authorization. The attack can be initiated remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

AnalysisAI

Cherry Studio's MCP OAuth Local Callback Server, in all versions up to 1.9.6, accepts OAuth authorization code callbacks without validating the OAuth state parameter, enabling authorization code injection attacks. The PR diff confirms that src/main/services/mcp/oauth/callback.ts processed any inbound code value without checking a bound state token, allowing a network-positioned attacker to substitute a malicious authorization code during an active OAuth flow. A public exploit has been disclosed via GitHub issue #15372; no confirmed patched release exists - only an unmerged fix PR (#15388) - and no active exploitation has been confirmed (not in CISA KEV).

Technical ContextAI

Cherry Studio is an Electron-based AI desktop client that integrates with Model Context Protocol (MCP) servers, some of which require OAuth 2.0 authentication. The affected component is a local HTTP server that handles the OAuth authorization code callback step - the redirect from the authorization server to a local URI after user consent. CWE-285 (Improper Authorization) applies because the callback handler omitted validation of the OAuth state parameter, a CSRF-prevention mechanism mandated by RFC 6749 that binds each authorization request to its corresponding callback. The fix PR adds expectedState propagation from the auth provider instance to the callback server, rejecting any request where state is absent or does not match the session-generated value. Tests added in the PR explicitly confirm that requests with missing or mismatched state receive HTTP 400 with body 'Invalid OAuth state'. The CPE string cpe:2.3:a:cherryhq:cherry-studio:*:*:*:*:*:*:*:* covers all releases through 1.9.6.

RemediationAI

The primary fix is the upstream patch in GitHub PR #15388 (https://github.com/CherryHQ/cherry-studio/pull/15388), which adds OAuth state validation to the local callback server. No officially released patched version has been confirmed - the PR awaited acceptance at time of analysis. Users building from source should cherry-pick the changes to MCPService.ts that pass expectedState from the auth provider to the callback handler and call authProvider.clearExpectedState() after use. Monitor the Cherry Studio releases page at https://github.com/CherryHQ/cherry-studio for a version beyond 1.9.6 that incorporates this fix. As a compensating control, avoid initiating MCP OAuth flows on untrusted or shared networks, reducing the window for a network-based race-condition injection. Disabling MCP integrations that require OAuth entirely eliminates all exposure until a patched release is available, at the cost of losing OAuth-protected MCP server functionality.