Executive brief
Relay Server, a tool that enables real-time collaboration for the Obsidian note-taking app, contains a security flaw that allows unauthorized users to access private documents. By simply omitting a security token, an attacker can gain full administrative permissions to read or modify shared documents. This could lead to the exposure of sensitive private notes or the unauthorized alteration of collaborative data.
Technical details
An authentication bypass vulnerability exists in Relay Server's multi-document WebSocket endpoints due to improper validation of the token query parameter. When authentication is enabled, the server incorrectly grants full administrative permissions to WebSocket connections that omit the token entirely. An unauthenticated remote attacker who knows or guesses a document ID can connect to the document sync WebSocket (paths /d/:doc_id/ws/:doc_id2 or /doc/ws/:doc_id) to intercept or tamper with document data. The vulnerability was introduced in version 0.9.0 with the addition of CBOR Web Token (CWT) support and is addressed in version 0.9.7.
Affected products
- No-Instructions Relay Server 0.9.0 through 0.9.6
Timeline
- 2026-04-27: advisory: GitHub Security Advisory published by vendor
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fixed in version 0.9.7