CVE-2026-54618: Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user
Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULTMCPTOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vaultread, vaultwrite, vaultsearch, vaultlist, vaultmove, and vaultdelete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a clientcredentials path by returning the configured VAULTOAUTHCLIENTSECRET. This issue is fixed in version 0.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Obsidian Web MCPto a version that resolves this vulnerability.Fixed in 0.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated remote access?
Deployments running versions prior to 0.2.0 are exposed if an unauthenticated remote caller can reach the intended tunnel deployment. No account, existing session, client authentication, or user interaction is required.
What can an attacker do after exploiting the OAuth endpoints?
An attacker can obtain the static VAULT_MCP_TOKEN and call /mcp against the entire vault. Available actions include reading, writing, searching, listing, moving, and deleting vault content.
Does enabling PKCE prevent exploitation?
No. PKCE is optional and does not stop an attacker from initiating their own authorization flow.
Are there additional affected OAuth paths beyond authorization-code exchange?
Yes. The unauthenticated /oauth/register endpoint returns the configured VAULT_OAUTH_CLIENT_SECRET, exposing a client_credentials path without authentication.
What version fixes the issue?
Upgrade Obsidian Web MCP to version 0.2.0.