Vulnerability  ·  2026-09-18

Obsidian Web MCP — unauthenticated OAuth authorization bypass grants full vault access

VulnerabilityHigh impactGlobalCVE-2026-54618
NVD published this CVSS 9.4 critical finding on Sept 17, 2026: the OAuth flow used to authorize AI-agent access to a user's Obsidian vault via this MCP server can be trivially bypassed, since the authorization and token endpoints perform no actual verification of the requesting party.
MCP servers that broker access to personal data stores (notes, documents) are an increasingly common agent integration; a completely bypassable OAuth flow means any attacker who can reach the server's HTTP endpoint gets unauthenticated full access to the victim's private vault content, a severe confidentiality failure for a widely-used personal-knowledge-management AI integration.
The /oauth/authorize endpoint issues an authorization code without any login, consent, or session check, and /oauth/token will exchange that code for the server's static VAULT_MCP_TOKEN without authenticating the requesting client, letting any unauthenticated remote attacker obtain full read/write access to the connected Obsidian vault.
obsidian-web-mcp < 0.2.0
Upgrade to obsidian-web-mcp >= 0.2.0; do not expose the MCP server to the public internet without additional authentication in front of it.
GitHub commit fix
See this in the live feed Explore related AI security and governance findings — updated every morning.
Open the feed →