This vulnerability affects the OAuth callback handling in CherryHQ cherry-studio (versions 1.9.0 to 1.9.6) specifically in the file src/main/services/mcp/oauth/callback.ts. Improper authorization arises from manipulation of the 'code' argument, potentially allowing unauthorized access. The attack vector is network-based with high complexity, no privileges required, and no user interaction needed. Although the exploit has been publicly disclosed, it is considered difficult to exploit. A pull request containing a fix is pending acceptance, and no official patch or remediation is currently available.

Successful exploitation could lead to improper authorization, potentially allowing an attacker to bypass intended access controls in the OAuth callback process. The impact is limited by the high complexity of the attack and the low exploitability. No known exploits are currently observed in the wild.

No official fix or patch is currently available. A pull request with a fix is awaiting acceptance. Users should monitor the vendor's repository or advisory channels for the official patch release. Until then, consider restricting access to the affected component or implementing additional authorization checks if feasible.