Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

Description

No description available.

Recommendation

Update the line-desktop-mcp package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.1
• Patched version(s): 1.1.2

References

• GHSA-4hf8-5mjm-rfgq
• CVE-2026-49357
• CWE-306
• CWE-862
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default - CVE-2026-54504
• Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods - CVE-2026-42047
• Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - @backstage/plugin-catalog-unprocessed-entities-common - CVE-2026-44374
• Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - CVE-2026-44374

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

line-desktop-mcp