CVE-2026-40263 - Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

Back Back to CVE browser

LOW

Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

Published Apr 16, 2026

3.7

LOW

CVSS 3.1

EPSS 0.31%

Description

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2.

Affected products

Vendor Enchant97 Product Note-Mark Default
n/a
- Version
  < 0.19.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Enchant97

Note-Mark

n/a

Version	Status	Constraints
< 0.19.2	affected	-

Ecosystem	Package	Introduced	Fixed
Go	github.com/enchant97/note-mark/backend	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-208

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23334
Advisory
https://github.com/advisories/GHSA-w6m9-39cv-2fwp
Advisory
https://github.com/enchant97/note-mark/commit/cf4c6f6acf70b569d80396d323b067c00d45c034
x_refsource_MISC
https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp
exploitx_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-40263

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23334		Advisory
https://github.com/advisories/GHSA-w6m9-39cv-2fwp		Advisory
https://github.com/enchant97/note-mark/commit/cf4c6f6acf70b569d80396d323b067c00d45c034		x_refsource_MISC
https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp		exploitx_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-40263