CVE-2026-49357: Line Desktop MCP Auth Bypass Vulnerability

CVE-2026-49357 Overview

CVE-2026-49357 is a missing authentication vulnerability [CWE-306] in line-desktop-mcp, a community project that lets users operate the LINE Desktop application on Windows and macOS through the Model Context Protocol (MCP). When the server runs with the --http-mode flag, it binds to 0.0.0.0 and exposes the /mcp endpoint without any MCP-layer authentication. Any network client that can reach the listening port can initialize a session, enumerate tools, and invoke them against the logged-in LINE Desktop instance. Versions prior to 1.1.2 are affected, and version 1.1.2 remediates the issue.

Critical Impact
Unauthenticated network attackers can read LINE chat history and send messages from the victim's account through the already authenticated desktop client.

Affected Products

line-desktop-mcp versions prior to 1.1.2
LINE Desktop on Windows (when fronted by vulnerable MCP server)
LINE Desktop on macOS (when fronted by vulnerable MCP server)

Discovery Timeline

2026-06-19 - CVE-2026-49357 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49357

Vulnerability Analysis

The line-desktop-mcp server implements a Streamable HTTP transport designed for integration with workflow tools such as n8n. In this --http-mode, the server binds to 0.0.0.0, meaning it accepts connections from any interface, not just localhost. The /mcp endpoint accepts standard MCP requests including initialize, tools/list, and tools/call, but performs no authentication or authorization at the MCP layer.

Because the MCP server proxies actions to a desktop application that is already logged in, the attacker inherits the session of the legitimate user. Available tools allow reading LINE chat history and sending messages as the victim. The vulnerability is network-reachable, requires no privileges, and requires no user interaction.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The HTTP transport was added for automation use cases without an accompanying access control mechanism. Binding to 0.0.0.0 instead of 127.0.0.1 widens exposure from local automation tooling to any reachable host on the network.

Attack Vector

An attacker on the same network, or anywhere reachable if the host is exposed through port forwarding or a VPN, sends an MCP initialize request to http://<target>:<port>/mcp. After the session is established, the attacker calls tools/list to enumerate available capabilities and then invokes message-read or message-send tools. The desktop application processes these requests in the context of the logged-in user.

javascript

// Patch excerpt: src/automation/macos-line-automation.js (v1.1.2)
tell application "${this.appleEsc(this.lineAppName)}"
  activate
end tell

-- 檢查是否成功成為前景
tell application "System Events"
    repeat with i from 1 to 3
        if frontmost of process "${this.appleEsc(this.lineAppName)}" is true then
            exit repeat
        else
            delay 0.5
            tell application "${this.appleEsc(this.lineAppName)}" to activate
        end if
    end repeat
end tell

-- 檢查是否超過重試次數
tell application "System Events"
    if frontmost of process "${this.appleEsc(this.lineAppName)}" is false then
        error "無法將 LINE 置於前景。"
    end if
end tell

Source: GitHub Commit 6806178. The patch hardens automation logic alongside the authentication fix in release 1.1.2.

Detection Methods for CVE-2026-49357

Indicators of Compromise

Unexpected inbound TCP connections to the MCP listener port on hosts running line-desktop-mcp
HTTP POST requests to the /mcp path from non-localhost source addresses
LINE messages sent or chat history accessed outside of normal user interaction windows
node or related runtime processes listening on 0.0.0.0 with a line-desktop-mcp working directory

Detection Strategies

Inventory endpoints running line-desktop-mcp and verify the installed version against 1.1.2
Inspect listening sockets with netstat -ano (Windows) or lsof -iTCP -sTCP:LISTEN (macOS) for the MCP port bound to 0.0.0.0
Review LINE Desktop activity logs for messages and reads that do not correlate with user presence

Monitoring Recommendations

Alert on new processes binding non-loopback addresses on workstations
Monitor egress from workstations to LINE servers outside expected user activity windows
Capture HTTP request metadata for /mcp endpoints behind any reverse proxy in use

How to Mitigate CVE-2026-49357

Immediate Actions Required

Upgrade line-desktop-mcp to version 1.1.2 or later on every affected host
Stop any running --http-mode instance until the upgrade is complete
Audit LINE chat history and sent messages for unauthorized activity during the exposure window

Patch Information

Version 1.1.2 of line-desktop-mcp fixes the issue. See the GitHub Security Advisory GHSA-4hf8-5mjm-rfgq and the patch commit 6806178 for details.

Workarounds

Run the MCP server only in stdio mode rather than --http-mode where feasible
Restrict the listener to 127.0.0.1 and use SSH or a local tunnel for remote automation
Place the /mcp endpoint behind an authenticated reverse proxy that enforces bearer tokens or mutual TLS
Use host firewall rules to limit inbound access to the MCP port to known automation hosts

bash

# macOS: block inbound traffic to the MCP port except from localhost
echo "block in proto tcp from any to any port 3000" | sudo pfctl -ef -

# Windows: allow only local loopback to the MCP listener
netsh advfirewall firewall add rule name="Block MCP External" \
  dir=in action=block protocol=TCP localport=3000 remoteip=!127.0.0.1