Read the docs
TI-2026-32452 Aliases CVE-2026-44523GHSA-q6mh-rqwh-g786

Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

Priority HIGH 82CWE-326Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-326 and CWE-345.

Summary

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00148 4th percentileScored 2026-11-07
Fix Fixed note-mark (enchant97): 0.19.4github.com/enchant97/note-mark/backend (Go): 0.0.0-20260501152247-18b587758667

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
enchant97note-markbefore 0.19.40.19.4Patch availableCNA
—github.com/enchant97/note-mark/backend (Go)before 0.0.0-20260501152247-18b5877586670.0.0-20260501152247-18b587758667Patch availableGHSA-q6mh-rqwh-g786
  • note-mark Vendorenchant97 Affected before 0.19.4 Fixed in 0.19.4 Patch available CNA
  • github.com/enchant97/note-mark/backend (Go) Vendor— Affected before 0.0.0-20260501152247-18b587758667 Fixed in 0.0.0-20260501152247-18b587758667 Patch available GHSA-q6mh-rqwh-g786

Remediation

  • Fix · CNA note-mark (enchant97) Fixed in 0.19.4
  • Fix · GHSA-q6mh-rqwh-g786 github.com/enchant97/note-mark/backend (Go) Fixed in 0.0.0-20260501152247-18b587758667 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44523
  2. 2026-10-03 Alias added: GHSA-q6mh-rqwh-g786

References

Advisory 1

Other 4

  • TI-2026-30126 Note Mark: OIDC-registered users authenticated by submitting password "null" CVSS 3.1CRITICAL 9.4
  • TI-2026-29056 Note Mark has Stored XSS via Unrestricted Asset Upload CVSS 3.1HIGH 8.7
  • TI-2026-37275 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) CVSS 4.0HIGH 8.6
  • TI-2026-32451 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution CVSS 4.0HIGH 8.6
  • TI-2026-37276 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark CVSS 3.1MEDIUM 5.3
  • TI-2026-30127 Note Mark: Unauthenticated read of notes and assets in soft-deleted public books CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences