{"id":"EUVD-2026-38016","enisaUuid":"d76ab853-9ce7-3050-b667-ad3cbb122aca","description":"Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on Windows or Mac via MCP. `line-desktop-mcp` supports a `--http-mode` Streamable HTTP transport for use with clients such as n8n. In this mode the server binds to `0.0.0.0` and exposes the MCP `/mcp` endpoint without an MCP-layer authentication check. Prior to version 1.1.2, any network client that can reach the port can initialize a session, list tools, and call tools that read LINE Desktop chat history or send LINE messages through the already logged-in desktop application. Version 1.1.2 fixes the issue.","datePublished":"Jun 19, 2026, 1:11:08 PM","dateUpdated":"Jun 22, 2026, 5:15:27 PM","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/dtwang/line-desktop-mcp/security/advisories/GHSA-4hf8-5mjm-rfgq\nhttps://github.com/dtwang/line-desktop-mcp/commit/680617894981ea93f8f6ceb51ecde7519754d501\n","aliases":"CVE-2026-49357\nGHSA-4hf8-5mjm-rfgq\n","assigner":"GitHub_M","epss":0.56,"enisaIdProduct":[{"id":"0cdc26cb-58c6-31c5-9cd8-40eddc30444a","product":{"name":"line-desktop-mcp","vendor":{"name":"dtwang"}},"product_version":"\u003c 1.1.2"}],"enisaIdVendor":[{"id":"ac1af4e0-928b-3a97-b630-4b6676f30f43","vendor":{"name":"dtwang"}}],"enisaIdVulnerability":[{"id":"01493d1e-902a-3e23-b33e-2e84446dd26a","vulnerability":{"id":"GHSA-4hf8-5mjm-rfgq","description":"Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication","datePublished":"Jun 26, 2026, 9:50:49 PM","dateUpdated":"Jun 26, 2026, 9:50:50 PM","baseScore":0.0,"references":"https://github.com/dtwang/line-desktop-mcp/security/advisories/GHSA-4hf8-5mjm-rfgq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49357\nhttps://github.com/dtwang/line-desktop-mcp/commit/680617894981ea93f8f6ceb51ecde7519754d501\nhttps://github.com/dtwang/line-desktop-mcp\n","enisa_id":"EUVD-2026-38016\n","aliases":"GHSA-4hf8-5mjm-rfgq\nCVE-2026-49357\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"429bb81f-5a94-3290-8c5a-eb5c1212cca7","vulnerability":{"id":"CVE-2026-49357","description":"Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on Windows or Mac via MCP. `line-desktop-mcp` supports a `--http-mode` Streamable HTTP transport for use with clients such as n8n. In this mode the server binds to `0.0.0.0` and exposes the MCP `/mcp` endpoint without an MCP-layer authentication check. Prior to version 1.1.2, any network client that can reach the port can initialize a session, list tools, and call tools that read LINE Desktop chat history or send LINE messages through the already logged-in desktop application. Version 1.1.2 fixes the issue.","datePublished":"Jun 19, 2026, 1:11:08 PM","dateUpdated":"Jun 22, 2026, 5:15:27 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/dtwang/line-desktop-mcp/security/advisories/GHSA-4hf8-5mjm-rfgq\nhttps://github.com/dtwang/line-desktop-mcp/commit/680617894981ea93f8f6ceb51ecde7519754d501\n","enisa_id":"EUVD-2026-38016\n","assigner":"GitHub_M","epss":0.56,"dataProcessed":"Nov 5, 2026, 7:19:06 AM","vulnerabilityProduct":[{"id":"fce2be7d-914a-3f0d-abd8-ba0bc902d34b","product":{"name":"line-desktop-mcp","vendor":{"name":"dtwang"}},"product_version":"\u003c 1.1.2"}],"vulnerabilityVendor":[{"id":"6e7be576-f505-3425-ad4e-308f48fa8999","vendor":{"name":"dtwang"}}]}}],"enisaIdAdvisory":[]}