Which versions of line-desktop-mcp are affected by CVE-2026-49357?

line-desktop-mcp versions prior to 1.1.2 contain a critical authentication bypass that allows remote attackers to read LINE chat history and send messages impersonating logged-in users when the…. A patch is available.

How to fix or mitigate CVE-2026-49357?

Within 24 hours: Upgrade line-desktop-mcp to version 1.1.2 or later; if immediate upgrade is not possible, disable --http-mode. Within 7 days: Complete inventory of all line-desktop-mcp deployments; review LINE Desktop application access logs for indicators of compromise. Within 30 days: Implement network segmentation restricting MCP endpoint access to trusted networks only via firewall rules; remove any public-facing HTTP bindings.

line-desktop-mcp CVE-2026-49357

Q: What is the CVSS score of CVE-2026-49357?

CVE-2026-49357 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38016 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-19 GitHub_M

GHSA-4hf8-5mjm-rfgq

Authentication Bypass Microsoft Line Desktop Mcp

8.8

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable /mcp with no auth (AV:N/AC:L/PR:N/UI:N); full chat-history disclosure gives C:H, ability to send messages as user gives I:L; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 19, 2026 - 15:32 EUVD

Source Code Evidence Fetched

Jun 19, 2026 - 14:17 vuln.today

Analysis Generated

Jun 19, 2026 - 14:17 vuln.today

CVE Published

Jun 19, 2026 - 13:11 cve.org

HIGH 8.8

DescriptionCVE.org

Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on Windows or Mac via MCP. line-desktop-mcp supports a --http-mode Streamable HTTP transport for use with clients such as n8n. In this mode the server binds to 0.0.0.0 and exposes the MCP /mcp endpoint without an MCP-layer authentication check. Prior to version 1.1.2, any network client that can reach the port can initialize a session, list tools, and call tools that read LINE Desktop chat history or send LINE messages through the already logged-in desktop application. Version 1.1.2 fixes the issue.

AnalysisAI

Missing authentication in line-desktop-mcp prior to 1.1.2 lets any network-reachable client invoke MCP tools that read LINE chat history and send messages through the logged-in LINE Desktop application. When started with --http-mode, the server binds 0.0.0.0 and exposes /mcp without an MCP-layer auth check, enabling unauthenticated remote abuse. No public exploit identified at time of analysis, but the fix (1.1.2) and commit are public, making reconstruction trivial.

Technical ContextAI

line-desktop-mcp is a Node.js Model Context Protocol server that automates the LINE Desktop client on Windows and macOS via OS-level UI automation (AppleScript / Windows automation), exposing tools to read chats and send messages. The --http-mode Streamable HTTP transport, intended for MCP clients like n8n, is implemented in src/server.js and historically bound to a port and accepted JSON-RPC requests under /mcp without verifying the caller. The root cause maps to CWE-306 (Missing Authentication for Critical Function): a security-sensitive control surface (acting as the logged-in LINE user) was reachable over the network without any credential check. The patch in commit 680617 adds a configurable --host (default 127.0.0.1) and a --token Bearer-token middleware on /mcp, returning 401 when the header is missing or wrong.

RemediationAI

Vendor-released patch: upgrade to line-desktop-mcp 1.1.2 or later (e.g. npx line-desktop-mcp@latest) and review the advisory at https://github.com/dtwang/line-desktop-mcp/security/advisories/GHSA-4hf8-5mjm-rfgq. If immediate upgrade is impossible, stop launching the server with --http-mode --host 0.0.0.0 and instead bind to 127.0.0.1 so only local processes can reach /mcp; this preserves localhost integrations such as n8n on the same host but breaks any cross-host MCP clients. Where remote access is required, upgrade and use the new --token Bearer-token option together with --host, and additionally restrict the listening port via host firewall or reverse-proxy ACLs since the token is the only authentication layer; logging out of LINE Desktop or stopping the server eliminates exposure entirely at the cost of disabling automation.