CVE-2026-40263

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/enchant97/note-mark/commit/cf4c6f6acf70b569d80396d323b067c00d45c034
https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp
https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Note Mark es una aplicación de código abierto para tomar notas. En las versiones 0.19.1 y anteriores, el endpoint de inicio de sesión realiza la verificación de contraseña bcrypt solo cuando el nombre de usuario proporcionado existe, devolviendo inmediatamente para nombres de usuario inexistentes. Esta discrepancia de tiempo permite a atacantes no autenticados enumerar nombres de usuario válidos midiendo los tiempos de respuesta, lo que permite ataques de credenciales dirigidos. Este problema ha sido solucionado en la versión 0.19.2.

Information

Published : 2026-04-17 01:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40263

Mitre link : CVE-2026-40263

CVE.ORG link : CVE-2026-40263

JSON object : View

Products Affected

No product.

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2026-40263", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40263", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T12:23:37.345690Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "enchant97", "product": "note-mark", "versions": [{"status": "affected", "version": "< 0.19.2"}]}]}], "published": "2026-04-17T01:17:40.137", "references": [{"url": "https://github.com/enchant97/note-mark/commit/cf4c6f6acf70b569d80396d323b067c00d45c034", "source": "security-advisories@github.com"}, {"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp", "source": "security-advisories@github.com"}, {"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2."}, {"lang": "es", "value": "Note Mark es una aplicaci\u00f3n de c\u00f3digo abierto para tomar notas. En las versiones 0.19.1 y anteriores, el endpoint de inicio de sesi\u00f3n realiza la verificaci\u00f3n de contrase\u00f1a bcrypt solo cuando el nombre de usuario proporcionado existe, devolviendo inmediatamente para nombres de usuario inexistentes. Esta discrepancia de tiempo permite a atacantes no autenticados enumerar nombres de usuario v\u00e1lidos midiendo los tiempos de respuesta, lo que permite ataques de credenciales dirigidos. Este problema ha sido solucionado en la versi\u00f3n 0.19.2."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security-advisories@github.com"}