Relay Server
Monthly
Authentication bypass in Relay Server 0.9.0-0.9.6 (the real-time collaboration backend for the Obsidian Relay plugin) lets unauthenticated network attackers read and modify synced documents. When authentication is enabled, the multi-document WebSocket endpoints incorrectly treated connections lacking a token query parameter as fully privileged, so anyone who knows or guesses a document ID can join the sync session without a valid document token. Publicly available exploit code exists per SSVC (POC), but EPSS is very low (0.04%) and it is not listed in CISA KEV, so there is no confirmed active exploitation.
Authentication bypass in Relay Server 0.9.0-0.9.6 (the real-time collaboration backend for the Obsidian Relay plugin) lets unauthenticated network attackers read and modify synced documents. When authentication is enabled, the multi-document WebSocket endpoints incorrectly treated connections lacking a token query parameter as fully privileged, so anyone who knows or guesses a document ID can join the sync session without a valid document token. Publicly available exploit code exists per SSVC (POC), but EPSS is very low (0.04%) and it is not listed in CISA KEV, so there is no confirmed active exploitation.