CVE-2026-54618 Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULTMCPTOKEN without authenticating a client. An unauthenticated...

CVE-2026-54618: Missing Authentication for Critical Function

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULTMCPTOKEN without authenticating a client. An unauthenticated...