CVE-2026-54618Published
Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-54618 · Microsoft / collected KEV context
cve-program · CVE-2026-54618
- https://github.com/jimprosser/obsidian-web-mcp/security/advisories/GHSA-hwhg-mrjc-8g43
- https://github.com/jimprosser/obsidian-web-mcp/pull/30
- https://github.com/jimprosser/obsidian-web-mcp/commit/e4924f096ee7494a7999d6c0cceca9be08e48eef
- https://github.com/jimprosser/obsidian-web-mcp/releases/tag/v0.2.0
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.