Product

Obsidian-Tc (< 1.3.1)

1 brief RSS

critical advisory

obsidian-tc: Remote vault access via HTTP transport (CVE-2026-77363)

The obsidian-tc package HTTP transport lacks Origin header validation and DNS-rebinding protection, allowing drive-by vault access via loopback.

obsidian-tc +1 auth-bypass multi-tenancy web-application npm vulnerability file-overwrite data-corruption