CVE-2026-44523

Published: May 14, 2026Modified: Jun 17, 2026Deferred

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.8

Source: security-advisories@github.com (Secondary)

Description

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (2)

https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786

Source: security-advisories@github.com

https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.