Vulnerability-Lookup

What it is

GHSA-9c5h-h4mj-p5ch / CVE-2026-13524, an improper-authorization flaw (CWE-266) in CherryHQ cherry-studio through version 1.9.6, in the MCP OAuth Local Callback Server (src/main/services/mcp/oauth/callback.ts). The existing summary omits the version boundary and the specific issue/PR to track — the two things an engineer needs to decide whether their build is exposed and where the fix will land.

How it works

Manipulation of the code argument in the OAuth local callback handler leads to an improper authorization decision. The advisory does not describe the exact bypass beyond "the manipulation of the argument code leads to improper authorization." It is remotely reachable, rated high attack complexity, and the advisory explicitly states exploitability is "difficult."

Preconditions / Affected

• cherry-studio up to and including 1.9.6.
• The MCP OAuth Local Callback Server component must be in use (i.e., MCP OAuth flows exercising the local callback server).
• Network reachability to the callback server; NVD marks overall severity LOW.

What to do

• No merged release fix exists as of publication — PR #15388 awaits acceptance. Track it and the originating report, issue #15372, on the CherryHQ/cherry-studio repo:
• https://github.com/CherryHQ/cherry-studio/pull/15388
• https://github.com/CherryHQ/cherry-studio/issues/15372
• Until merged, treat any 1.9.6-or-earlier install with MCP OAuth enabled as unpatched.

Caveats

• A public PoC is disclosed ("the exploit has been disclosed publicly and may be used"), but the advisory itself flags exploitation as difficult and high-complexity — weigh the disclosed PoC against that stated difficulty.
• CVSS scoring is inconsistent across sources: the vector strings compute to low-to-moderate (3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L), and GitHub's database_specific.severity is LOW. The existing summary's "6.5" is not stated on this page.
• github_reviewed is false — this advisory has not been GitHub-reviewed, and the affected-package list is empty, so automated dependency tooling may not flag it.