CVE-2025-56449: Authentication Bypass by Spoofing
Source CVE Database V5
Not known to be exploited · CVSS 8.2 High.
Data as of 26 Oct 2026, 13:47 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 31% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 29 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Immediately disable Basic Authentication on the Obsidian Scheduler REST API or restrict its use to trusted networks and IP addresses.
- Enforce consistent MFA policies across all access methods, including web interfaces and APIs, ensuring that lockout states apply uniformly.
- Audit and rotate credentials for all administrative accounts, especially default accounts, to prevent unauthorized access.
- Implement network-level controls such as IP whitelisting and VPN requirements for accessing the REST API.
- Monitor API access logs for unusual authentication attempts or creation of new privileged users.
- Apply compensating controls such as Web Application Firewalls (WAFs) to detect and block suspicious API calls.
- Engage with Obsidian Scheduler vendors for patches or updates addressing this vulnerability and plan timely deployment.
- Conduct regular security assessments and penetration testing focusing on API authentication mechanisms.
- Educate administrators and users about the risks of bypassing MFA and the importance of secure authentication practices.
- Integrate anomaly detection systems to alert on deviations in administrative account behaviors.
Description
A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g.after the 7-day enforcement window), the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions. In particular, the default admin account was found to be locked out via the web interface but still usable through the REST API. This allowed creation of a new privileged user, bypassing MFA protections. This undermines the intended security posture of MFA enforcement.