obsidian-web-mcp vulnerabilities

CVEs whose affected-version data names the obsidian-web-mcp package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-54618Critical· 9.4PoC

1w ago

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MC…

▾ Abyssaljimprosser · obsidian-web-mcpEPSS 0.51%via NVD