CVE-2026-44523

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786
https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Note Mark es una aplicación de código abierto para tomar notas. Antes de la 0.19.4, no se aplica una longitud mínima ni una entropía al valor de configuración JWT_SECRET. La aplicación acepta cualquier secreto decodificable en base64, independientemente de su tamaño, incluyendo secretos de tan solo 1 byte. Esta vulnerabilidad se corrige en la versión 0.19.4.

Information

Published : 2026-05-14 19:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44523

Mitre link : CVE-2026-44523

CVE.ORG link : CVE-2026-44523

JSON object : View

Products Affected

No product.

CWE

CWE-326

Inadequate Encryption Strength

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2026-44523", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44523", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-15T14:54:44.490880Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "enchant97", "product": "note-mark", "versions": [{"status": "affected", "version": "< 0.19.4"}]}]}], "published": "2026-05-14T19:16:37.470", "references": [{"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786", "source": "security-advisories@github.com"}, {"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-326"}, {"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4."}, {"lang": "es", "value": "Note Mark es una aplicaci\u00f3n de c\u00f3digo abierto para tomar notas. Antes de la 0.19.4, no se aplica una longitud m\u00ednima ni una entrop\u00eda al valor de configuraci\u00f3n JWT_SECRET. La aplicaci\u00f3n acepta cualquier secreto decodificable en base64, independientemente de su tama\u00f1o, incluyendo secretos de tan solo 1 byte. Esta vulnerabilidad se corrige en la versi\u00f3n 0.19.4."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}