Tracking: CVE-2026-54618
Severity: Critical
Who is affected
obsidian-web-mcp before 0.2.0 with the affected OAuth endpoints reachable. The service uses a static VAULT_MCP_TOKEN for vault access.
How the attack works
/oauth/authorize issues authorization codes without enforcing login, consent, or an existing user session. The token exchange then returns the static vault token without the required client authentication. The report also identifies unauthenticated registration exposing VAULT_OAUTH_CLIENT_SECRET, enabling another credential-based path.
A caller who obtains vault access can read, search, write, move, list, or delete content. PKCE alone cannot fix an authorization flow that permits the attacker to initiate and complete the transaction.
What to do
- Upgrade to 0.2.0 or later and restrict the service while applying the change.
- Rotate both the vault token and OAuth client secret if the vulnerable endpoints were exposed.
- Review authorization, registration, and vault activity. Compare sensitive notes and files with trusted history, and investigate unauthorized changes or deletion.
Scope and limits
Patching the endpoint does not revoke a static token already issued to an attacker. Credential rotation is part of recovery.