CVE-2026-44523 - Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

Back Back to CVE browser

CRITICAL

Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

Published May 14, 2026

10.0

CRITICAL

CVSS 3.1

EPSS 0.16%

Description

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.

Affected products

Vendor Enchant97 Product Note-Mark Default
n/a
- Version
  < 0.19.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Enchant97

Note-Mark

n/a

Version	Status	Constraints
< 0.19.4	affected	-

github.com/enchant97/note-mark/backend

Go

Introduced 0 Fixed 0.0.0-20260501152247-18b587758667

Ecosystem	Package	Introduced	Fixed
Go	github.com/enchant97/note-mark/backend	0	0.0.0-20260501152247-18b587758667

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-326

Inadequate Encryption Strength

CWE-345

References (6)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30367		Advisory
https://github.com/advisories/GHSA-q6mh-rqwh-g786		Advisory
https://github.com/enchant97/note-mark/commit/18b58775866776ed400c403dd0ccad68c1fa4802
https://github.com/enchant97/note-mark/releases/tag/v0.19.4
https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786		exploitx_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-44523