PT-2026-32119 · Note Mark · Note Mark

Published 2026-04-11 · Updated 2026-04-17 · CVE-2026-40263

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Note Mark versions prior to 0.19.2

Description A timing side-channel in the login endpoint allows unauthenticated attackers to determine whether a username exists by measuring response time differences. The server performs bcrypt password verification only when the supplied username exists, causing requests for valid usernames to take noticeably longer than requests for nonexistent usernames. This discrepancy enables remote username enumeration, which can be used to facilitate targeted credential attacks. The issue affects the 'POST /api/auth/token' endpoint and is caused by the server executing the bcrypt.CompareHashAndPassword function only after a user is found in the database, without performing a constant-time equalization for nonexistent users.

Recommendations Update to version 0.19.2.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-40263

GHSA-W6M9-39CV-2FWP

Affected Products

Note Mark

References · 9

• 🔥 https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40263 · Security Note
• https://osv.dev/vulnerability/GHSA-w6m9-39cv-2fwp · Vendor Advisory
• https://github.com/enchant97/note-mark · Note
• https://github.com/enchant97/note-mark/commit/cf4c6f6acf70b569d80396d323b067c00d45c034 · Note
• https://twitter.com/CVEnew/status/2045102627143164320 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044955927434928621 · Twitter Post
• https://reddit.com/r/enchantedcode/comments/1silry3/note_mark_v0192_security_update · Reddit Post
• https://reddit.com/r/selfhosted/comments/1sim2hk/note_mark_v0192_security_update · Reddit Post