CVE-2026-54618

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a client_credentials path by returning the configured VAULT_OAUTH_CLIENT_SECRET. This issue is fixed in version 0.2.0.

• CWE-306
• CWE-522
• CWE-601

• https://github.com/jimprosser/obsidian-web-mcp/commit/e4924f096ee7494a7999d6c0cceca9be08e48eef
• https://github.com/jimprosser/obsidian-web-mcp/pull/30
• https://github.com/jimprosser/obsidian-web-mcp/releases/tag/v0.2.0
• https://github.com/jimprosser/obsidian-web-mcp/security/advisories/GHSA-hwhg-mrjc-8g43
• https://github.com/jimprosser/obsidian-web-mcp/security/advisories/GHSA-hwhg-mrjc-8g43

Published

Sep 17, 2026

Last Modified

Sep 24, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54611InstantCMS is a free and open source content management syst…5.5
• CVE-2026-54612Vvveb is a powerful and easy to use CMS with page builder to…8.8
• CVE-2026-54613Vvveb is a powerful and easy to use CMS with page builder to…5.4
• CVE-2026-54614DebugKit provides a debugging toolbar for CakePHP applicatio…4.3
• CVE-2026-54616NanaZip is the 7-Zip derivative intended for the modern Wind…7.1
• CVE-2026-54617GravitLauncher is an open-source Minecraft launcher based on…9.8
• CVE-2026-54619sqlite3 provides Ruby bindings for the SQLite3 embedded data…2
• CVE-2026-5462A vulnerability was identified in Wahoo Fitness SYSTM App up…3.3
• CVE-2026-54620sqlite3 provides Ruby bindings for the SQLite3 embedded data…2
• CVE-2026-54621datamodel-code-generator generates Python data models from s…7.8
• CVE-2026-54622django CMS is an easy-to-use and developer-friendly enterpri…6.5
• CVE-2026-54623django CMS is an easy-to-use and developer-friendly enterpri…7.1