CVE-2026-44523 Details

A vulnerability in Note Mark, an open-source note-taking application, prior to version 0.19.4, allows for full account takeover through token forgery. The issue arises because the application does not enforce a minimum length or entropy for the JWT_SECRET configuration value. As a result, the application accepts any base64-decodable secret, including those as short as 1 byte. This vulnerability is critical, as it enables an attacker to capture a valid JWT, crack the signing secret offline, forge JWTs for any user (including administrators), and authenticate without credentials, all without server-side detection or rate limiting.

Users are advised to update to Note Mark version 0.19.4 or later, where this vulnerability has been fixed. Additionally, ensure that JWT secrets are at least 32 bytes (256 bits) after base64 decoding and reject weaker secrets during configuration parsing.