CVE-2025-56449: High severity Obsidian Scheduler vulnerability
A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after the 7-day enforcement window), the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions. In particular, the default admin account was found to be locked out via the web interface but still usable through the REST API. This allowed creation of a new privileged user, bypassing MFA protections. This undermines the intended security posture of MFA enforcement.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-56449?
CVE-2025-56449 is considered a high severity vulnerability due to its potential for unauthorized administrative actions.
How do I fix CVE-2025-56449?
To fix CVE-2025-56449, upgrade Obsidian Scheduler to version 6.3.1 or later, which addresses the issue.
What does CVE-2025-56449 affect?
CVE-2025-56449 affects the REST API of Obsidian Scheduler versions 5.0.0 through 6.3.0.
What are the consequences of CVE-2025-56449?
The consequences of CVE-2025-56449 include potential unauthorized access to administrative functions if an account is locked out.
Is MFA required to mitigate CVE-2025-56449?
While MFA is enforced, the vulnerability allows bypassing it through Basic Authentication, emphasizing the need for immediate action to upgrade.