CVE-2026-13524: CherryHQ cherry-studio Auth Bypass Flaw

CVE-2026-13524 Overview

CVE-2026-13524 is an improper authorization vulnerability [CWE-266] in CherryHQ cherry-studio versions up to 1.9.6. The flaw resides in src/main/services/mcp/oauth/callback.ts, which implements the Model Context Protocol (MCP) OAuth Local Callback Server. Manipulation of the code argument leads to improper authorization handling during the OAuth callback flow. The attack can be initiated remotely, but exploitation is considered difficult due to high attack complexity. The exploit has been publicly disclosed, and a pull request to remediate the issue is pending acceptance upstream.

Critical Impact
Remote attackers can manipulate the OAuth callback code parameter to bypass authorization controls in the MCP local callback server, though successful exploitation requires satisfying high-complexity preconditions.

Affected Products

CherryHQ cherry-studio versions up to and including 1.9.6
Component: MCP OAuth Local Callback Server (src/main/services/mcp/oauth/callback.ts)
Deployments exposing the local OAuth callback listener to network-reachable endpoints

Discovery Timeline

2026-06-29 - CVE-2026-13524 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13524

Vulnerability Analysis

The vulnerability affects the MCP OAuth Local Callback Server component within cherry-studio, an AI desktop client. During the OAuth authorization code flow, the callback endpoint receives a code parameter that the client exchanges for an access token. The implementation in callback.ts does not correctly enforce authorization checks tied to that code value. An attacker who can reach the local callback listener and supply a crafted code argument can trigger improper authorization behavior. The advisory classifies the weakness under CWE-266 (Incorrect Privilege Assignment), reflecting a mismatch between authorization state and the privileges granted after callback processing.

Root Cause

The root cause is insufficient validation of the OAuth code parameter within the local callback handler. The callback server accepts values that should be rejected, or associates them with authorization contexts they do not belong to. This class of flaw commonly arises when state parameters, PKCE verifiers, or client bindings are not strictly enforced against inbound callbacks in local loopback OAuth flows.

Attack Vector

Exploitation occurs over the network against the MCP OAuth local callback listener. An attacker crafts a request to the callback endpoint containing a manipulated code value. Successful exploitation depends on race conditions or specific state alignment with an in-progress OAuth flow, which is why the advisory rates attack complexity as high and exploitability as difficult. No authentication and no user interaction are required to submit the crafted callback. Detailed exploitation technique is described in the public disclosure. See GitHub Issue #15372 and VulDB CVE-2026-13524 for the disclosure details.

Detection Methods for CVE-2026-13524

Indicators of Compromise

Unexpected inbound connections to the cherry-studio MCP OAuth local callback port from non-loopback sources
Callback requests containing anomalous or repeated code parameter values that do not correspond to user-initiated OAuth flows
MCP OAuth token exchanges occurring without a corresponding user-initiated authorization event in application logs

Detection Strategies

Monitor process telemetry for cherry-studio instances binding OAuth callback listeners on non-loopback interfaces
Inspect HTTP access logs for the local callback server for requests with malformed or replayed code values
Correlate MCP session establishment events with preceding user-driven browser authorization to detect out-of-band callback invocations

Monitoring Recommendations

Track cherry-studio version inventory and flag hosts running versions at or below 1.9.6
Log all requests received by the MCP OAuth callback endpoint including source IP, code, and state parameters
Alert on any callback source address outside 127.0.0.1 or ::1 reaching the local OAuth listener

How to Mitigate CVE-2026-13524

Immediate Actions Required

Restrict the MCP OAuth callback listener to the loopback interface only, blocking external network access
Track the upstream fix in GitHub Pull Request #15388 and apply the patched build once merged and released
Limit use of MCP OAuth-integrated servers to trusted providers until the fix is deployed

Patch Information

As of the last NVD update on 2026-06-30, no released version contains the fix. The remediation is proposed in GitHub Pull Request #15388 and awaits acceptance. Users should monitor the CherryHQ cherry-studio repository for a release incorporating the fix and upgrade past version 1.9.6 once available.

Workarounds

Bind the OAuth callback server strictly to 127.0.0.1 and enforce a host firewall rule blocking external access to the callback port
Avoid running cherry-studio on multi-user or shared hosts where local processes could reach the callback listener
Disable MCP OAuth integrations in cherry-studio until an updated release is installed

bash

# Example host firewall rule to restrict access to the local callback port
# Replace CALLBACK_PORT with the port used by cherry-studio's MCP OAuth listener
sudo iptables -A INPUT -p tcp --dport CALLBACK_PORT ! -s 127.0.0.1 -j DROP