Skip to content
OpenAdvisories

Vendor

jimprosser

1 known vulnerabilities.

Products

obsidian-web-mcp 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.4
    CVE-2026-54618

    Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user

    Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authen…

    jimprosser obsidian-web-mcp