{"id":"CVE-2026-54618","aliases":["EUVD-2026-82406","GHSA-hwhg-mrjc-8g43"],"status":"published","title":"Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user","description":"Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a client_credentials path by returning the configured VAULT_OAUTH_CLIENT_SECRET. This issue is fixed in version 0.2.0.","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00507,"percentile":0.43778,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306","CWE-522","CWE-601"],"published":"2026-09-17T19:45:15Z","modified":"2026-10-28T02:30:37Z","products":[{"vendor":"jimprosser","product":"obsidian-web-mcp"}],"references":[{"url":"https://github.com/jimprosser/obsidian-web-mcp/security/advisories/GHSA-hwhg-mrjc-8g43","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/jimprosser/obsidian-web-mcp/pull/30","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/jimprosser/obsidian-web-mcp/commit/e4924f096ee7494a7999d6c0cceca9be08e48eef","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/jimprosser/obsidian-web-mcp/releases/tag/v0.2.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54618.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54618","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-54618","title":"Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user","description":"Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a client_credentials path by returning the configured VAULT_OAUTH_CLIENT_SECRET. This issue is fixed in version 0.2.0.","status":"published","published":"2026-09-17T19:45:15.384Z","modified":"2026-09-24T20:40:37.956Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-306","CWE-522","CWE-601"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-82406","description":"Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a client_credentials path by returning the configured VAULT_OAUTH_CLIENT_SECRET. This issue is fixed in version 0.2.0.","status":"published","published":"2026-09-17T19:45:15Z","modified":"2026-09-24T20:40:37Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T17:27:56.296478Z"}],"nvd":[{"id":"CVE-2026-54618","description":"Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a client_credentials path by returning the configured VAULT_OAUTH_CLIENT_SECRET. This issue is fixed in version 0.2.0.","status":"published","published":"2026-09-17T20:16:51.823Z","modified":"2026-09-30T17:32:07.107Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"secondary"}],"cwes":["CWE-306","CWE-522","CWE-601"],"updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"CVE-2026-54618","title":"Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user","description":"Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a client_credentials path by returning the configured VAULT_OAUTH_CLIENT_SECRET. This issue is fixed in version 0.2.0.","status":"published","published":"2026-09-17T19:45:15.384Z","modified":"2026-10-28T02:30:37.860786193Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-306","CWE-522","CWE-601"],"updated_at":"2026-11-02T15:45:10.818486Z"}]}}