PT-2026-38622 · Note Mark · Note Mark

Osageling · Published 2026-05-07 · Updated 2026-05-14 · CVE-2026-44523

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions note-mark (affected versions not specified)

Description The application does not enforce a minimum length or entropy for the JWT SECRET configuration value, accepting any base64-decodable secret regardless of size. In backend/config/utils.go, the Base64Decoded.UnmarshalText() function decodes the secret without validating its length. Additionally, in backend/core/auth.go, tokens are signed using HS256 without minimum key size requirements. Secrets shorter than 32 bytes are susceptible to offline brute-force attacks, which allow an attacker to recover the signing key and forge valid JSON Web Tokens (JWT) for any user, including administrators, leading to full account takeover.

Recommendations Enforce a minimum of 32 bytes (256 bits) for JWT secrets after base64 decoding. Reject weak secrets during configuration parsing in the Base64Decoded.UnmarshalText() function or during configuration validation.

Exploit

Fix

Insufficient Verification of Data Authenticity

Inadequate Encryption Strength

Weakness Enumeration

CWE-345

CWE-326

Related Identifiers

CVE-2026-44523

GHSA-Q6MH-RQWH-G786

Affected Products

Note Mark

References · 8

• 🔥 https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786 · Exploit
• https://osv.dev/vulnerability/GHSA-q6mh-rqwh-g786 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44523 · Security Note
• https://github.com/enchant97/note-mark/releases/tag/v0.19.4 · Note
• https://github.com/enchant97/note-mark/commit/18b58775866776ed400c403dd0ccad68c1fa4802 · Note
• https://github.com/enchant97/note-mark · Note
• https://twitter.com/vulert_official/status/2052663638364954996 · Twitter Post
• https://twitter.com/dailycve/status/2052601087350218753 · Twitter Post