by Kastro
Paper/Archive/CVE-2026-44523

CVE-2026-44523

enchant97 note-mark — Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

EPSS 0.1%public exploitCVSS 10.0
critical.is priorityof 100
41
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 4.0.040 × 200.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.

Affected

ProductAffectedFixed inSource
note-mark< 0.19.4–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786