Vulnerability  ·  2026-09-19

Obsidian Web MCP — OAuth flow issues authorization codes without login/consent check, enabling unauthenticated vault access

VulnerabilityHigh impactGlobalCVE-2026-54618
Obsidian Web MCP, a remote MCP server exposing Obsidian vaults to AI agents, shipped an OAuth implementation that skips authentication entirely, allowing any network client to obtain the static vault access token used by connected LLM agents.
This is a complete authentication bypass on an MCP server that brokers AI-agent access to personal knowledge vaults; an attacker gains the same tool access an authorized agent would have, including reading/writing vault content, illustrating the broader pattern of MCP servers shipping broken auth around agent-facing tool endpoints.
The /oauth/authorize endpoint issues a valid authorization code without any login, consent, or session check; /oauth/token then exchanges that code for the server's static VAULT_MCP_TOKEN without authenticating the requesting client, letting any unauthenticated remote party mint a token granting MCP access to the vault.
Obsidian Web MCP < 0.2.0
Upgrade to Obsidian Web MCP 0.2.0 or later.
GitHub commit (fix)NVD CVE-2026-54618
See this in the live feed Explore related AI security and governance findings — updated every morning.
Open the feed →