npm: obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

npm: obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP vulnerability discovered by ? in WordPress npm obsidian-tc versions = 1.13.0, = 1.31.3...

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

Summary On a Streamable HTTP deployment with auth.jwtSecret configured, serving a 2026-07-28-era client that declared elicitation.form support, a call to a dispatch-gated tool destructive: true, or a scope with an HITL floor that was offered an inputRequired confirmation could still complete afte...