CVE-2026-42889CRITICAL 9.1EPSS p28.3%
CVE-2026-42889CVE-2026-42889
Description
Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full server permissions. An unauthenticated network attacker who knows or guesses a document ID could connect to the document sync WebSocket and read or modify document contents without a valid document token. This vulnerability is fixed in 0.9.7.
Scoring
| CVSS 3.1 | 9.1 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | 0.37% probability of exploitation · percentile 28.3% · 2026-06-19T12:03:05Z |
| Published | 2026-05-12 |
| Last modified | 2026-05-13 |
Underlying weaknesses· 2
References
2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Authorization Bypass Through User-Controlled Keycwe-639 | 0% | live |
| Weakness | Incorrect Authorizationcwe-863 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.