CVE-2026-13524: Authorization Bypass in CherryHQ cherry-studio OAuth Callback

Technical summary

CVE-2026-13524 is a medium-severity authorization vulnerability (CVSS 3.1 score: 5.6) affecting the MCP OAuth Local Callback Server in cherry-studio. The flaw resides in src/main/services/mcp/oauth/callback.ts, where the 'code' parameter passed to the OAuth callback endpoint undergoes insufficient validation. The vulnerability maps to CWE-266 (Improper Privilege Assignment) and CWE-285 (Improper Authorization), indicating that the application fails to correctly verify user entitlements or deny access based on authorization policies. The remote, network-accessible attack vector combined with high attack complexity suggests the vulnerability requires specific prerequisites or environmental conditions to exploit successfully.

Business impact

Successful exploitation could enable unauthorized access to protected OAuth-authenticated resources or allow token hijacking within the cherry-studio environment. For organizations using cherry-studio as part of their development or integration workflows, this may expose sensitive credentials, unauthorized API access, or manipulation of integrations with external services. The impact is limited to confidentiality, integrity, and availability each at low severity—indicating localized rather than systemic compromise—but the remote nature means the risk is not geographically or network-perimeter bound.

Affected systems

CherryHQ cherry-studio versions up to and including 1.9.6 are confirmed vulnerable. No vendor product list was provided in the advisory, suggesting this may be a standalone application or the vendor catalog is incomplete. Verify your deployed version against CherryHQ's official release history and check whether your environment relies on cherry-studio's OAuth callback functionality, particularly in multi-service or third-party integration scenarios.

Exploitability

Public exploit disclosure has already occurred, increasing the practical risk of active exploitation. However, the vulnerability itself carries high attack complexity, meaning an attacker must satisfy non-trivial preconditions: understanding the OAuth flow, correctly crafting the malicious 'code' parameter, and ensuring the callback handler processes it under exploitable conditions. No credential or user interaction is required once the attack is initiated, and the network vector means any remote system can attempt exploitation. Organizations should not rely on complexity alone for defense; prompt patching remains essential.

Remediation

A pull request to remediate this issue has been submitted and awaits acceptance by the maintainers. Monitor the CherryHQ cherry-studio repository for merged fixes and plan an upgrade path to patched versions once released. Verify against the official CherryHQ advisory or GitHub repository for confirmation of the fixed version number. In the interim, mitigate by restricting network access to the MCP OAuth callback endpoint to trusted clients, implementing Web Application Firewall rules to detect malicious 'code' parameters, and monitoring OAuth callback logs for anomalous requests.

Patch guidance

Upgrade cherry-studio to the first version released after the fix is merged. Track CherryHQ's official release notes and security advisories to identify the patched version. If you are running cherry-studio in a container or package manager, enable automatic updates or establish a rapid patching cycle for security releases. Test the patch in a non-production environment first to ensure compatibility with your MCP integrations and dependent services.

Detection guidance

Monitor OAuth callback logs for requests with unusual or malformed 'code' parameters, repeated failed callback attempts from the same remote IP, or callbacks that trigger authorization errors. Implement SIEM alerts on authentication failures related to the /mcp/oauth/callback endpoint. Network-based detection could include inspecting HTTP requests to the callback handler for parameter tampering or token injection patterns. Consider enabling debug logging on the MCP OAuth service to capture full request details for forensic analysis.

Why prioritize this

Although the CVSS score is medium (5.6), the public availability of exploit details combined with the remote attack vector and lack of authentication requirements elevates practical risk. Organizations with cherry-studio in production should prioritize patching once a fix is available. The high attack complexity provides some time for planning, but should not delay remediation indefinitely. If cherry-studio is not exposed to the internet or is behind strict network controls, risk is reduced; in open or hybrid environments, treat as high priority.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects a network-accessible vulnerability with no privilege or user interaction requirement, tempered by high attack complexity and low impact across confidentiality, integrity, and availability. The score of 5.6 positions this as medium severity. The published exploit lowers the barrier for attackers despite the technical complexity, making the practical exploitability higher than the CVSS score alone suggests. Not listed in CISA's Known Exploited Vulnerabilities catalog, but early public disclosure warrants close monitoring.

Frequently asked questions