Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-54618Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user

Critical 9.4

In plain English

A critical-severity missing authentication in obsidian-web-mcp from jimprosser. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)9.4Critical
Exploit odds (30 days)0.5%top 56.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a client_credentials path by returning the configured VAULT_OAUTH_CLIENT_SECRET. This issue is fixed in version 0.2.0.

Affected products (as reported)

VendorProductVersions
jimprosser obsidian-web-mcp < 0.2.0

Weakness: CWE-306, CWE-522, CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References