CVE-2025-56449

A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0

High · published September 29, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after the 7-day enforcement window), the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions. In particular, the default admin account was found to be locked out via the web interface but still usable through the REST API. This allowed creation of a new privileged user, bypassing MFA protections. This undermines the intended security posture of MFA enforcement.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.4th percentile
Published
2025-09-29T00:00Z
EPSS history
Timeline
  • 29 SEP 00:00Z
    A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0
    cvelistv5