CVE-2025-56449

{
  "id": "CVE-2025-56449",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-29T15:16:08.653",
  "lastModified": "2026-11-05T23:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after the 7-day enforcement window), the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions. In particular, the default admin account was found to be locked out via the web interface but still usable through the REST API. This allowed creation of a new privileged user, bypassing MFA protections. This undermines the intended security posture of MFA enforcement."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de seguridad fue identificada en la API REST de Obsidian Scheduler de la versión 5.0.0 a la 6.3.0. Si una cuenta está bloqueada debido a no haberse inscrito en MFA (por ejemplo, después del período de aplicación de 7 días), la API REST aún permite el uso de Autenticación Básica para autenticar y realizar acciones administrativas. En particular, se encontró que la cuenta de administrador predeterminada estaba bloqueada a través de la interfaz web pero aún era utilizable a través de la API REST. Esto permitió la creación de un nuevo usuario privilegiado, eludiendo las protecciones de MFA. Esto socava la postura de seguridad prevista de la aplicación de MFA."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-29T15:40:09.687082Z",
          "id": "CVE-2025-56449",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://blog.gregscharf.com/2025/07/11/upcoming-vulnerability-advisory/",
      "source": "[email protected]"
    },
    {
      "url": "https://blog.gregscharf.com/2025/07/31/obsidian-scheduler-access-control-vulnerability/",
      "source": "[email protected]"
    },
    {
      "url": "https://wiki.obsidianscheduler.com/docs/Release_Notes#Obsidian_6.3.1",
      "source": "[email protected]"
    }
  ]
}