CVE-2026-40263 Details

A timing side-channel vulnerability has been identified in the Note Mark application, specifically in the login endpoint of versions through 0.19.1. This vulnerability allows unauthenticated attackers to enumerate valid usernames by measuring response times. The login endpoint performs bcrypt password verification only for existing usernames, causing a noticeable delay, while requests for nonexistent usernames are processed immediately. This timing discrepancy can be exploited to confirm the existence of usernames, thereby facilitating targeted credential attacks.

Users can update to Note Mark version 0.19.2, which addresses this vulnerability by ensuring that the login endpoint processes username existence checks in a way that does not leak information through timing differences.