What happened
NVD published this CVSS 9.4 critical finding on Sept 17, 2026: the OAuth flow used to authorize AI-agent access to a user's Obsidian vault via this MCP server can be trivially bypassed, since the authorization and token endpoints perform no actual verification of the requesting party.
Why it matters
MCP servers that broker access to personal data stores (notes, documents) are an increasingly common agent integration; a completely bypassable OAuth flow means any attacker who can reach the server's HTTP endpoint gets unauthenticated full access to the victim's private vault content, a severe confidentiality failure for a widely-used personal-knowledge-management AI integration.
Attack vector
The /oauth/authorize endpoint issues an authorization code without any login, consent, or session check, and /oauth/token will exchange that code for the server's static VAULT_MCP_TOKEN without authenticating the requesting client, letting any unauthenticated remote attacker obtain full read/write access to the connected Obsidian vault.
Affected systems
obsidian-web-mcp < 0.2.0
Mitigation
Upgrade to obsidian-web-mcp >= 0.2.0; do not expose the MCP server to the public internet without additional authentication in front of it.