CVE-2026-44523 — Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any…

Published: 2026-05-14 · CVSS: 10.0 · CVSS 3.1

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.

Original CVE JSON · STIX 2.1

Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7