What happened
Obsidian Web MCP, a remote MCP server exposing Obsidian vaults to AI agents, shipped an OAuth implementation that skips authentication entirely, allowing any network client to obtain the static vault access token used by connected LLM agents.
Why it matters
This is a complete authentication bypass on an MCP server that brokers AI-agent access to personal knowledge vaults; an attacker gains the same tool access an authorized agent would have, including reading/writing vault content, illustrating the broader pattern of MCP servers shipping broken auth around agent-facing tool endpoints.
Attack vector
The /oauth/authorize endpoint issues a valid authorization code without any login, consent, or session check; /oauth/token then exchanges that code for the server's static VAULT_MCP_TOKEN without authenticating the requesting client, letting any unauthenticated remote party mint a token granting MCP access to the vault.
Affected systems
Obsidian Web MCP < 0.2.0
Mitigation
Upgrade to Obsidian Web MCP 0.2.0 or later.