CVE-2026-44523: enchant97 Note Mark weak JWT secret allows account takeover

Executive brief

Note Mark, a self-hosted note-taking application, contains a security flaw in how it handles authentication tokens. The system allows administrators to use extremely short or weak security keys, which can be easily guessed by automated tools. If an attacker successfully guesses this key, they can create fake login credentials to take over any user account, including administrator accounts, gaining full access to all stored notes and system settings.

Technical details

The Note Mark backend fails to enforce minimum length or entropy requirements for the JWT_SECRET configuration value in 'backend/config/utils.go'. While RFC 7518 requires HS256 keys to be at least 256 bits (32 bytes), the application accepts secrets as short as 1 byte. An attacker can capture a valid JWT from network traffic or cookies and perform an offline brute-force or dictionary attack to recover the weak secret. Once recovered, the attacker can forge JWTs for any user ID, including administrators, bypassing authentication entirely. The vulnerability is addressed in version 0.0.0-20260501152247-18b587758667 (v0.19.4).

Affected products

• enchant97 note-mark/backend < 0.0.0-20260501152247-18b587758667

Timeline

• 2026-05-02: disclosed: Vulnerability disclosed in enchant97/note-mark repository.
• 2026-05-07: advisory: GitHub Advisory GHSA-q6mh-rqwh-g786 published.
• 2026-05-14: patched: CVE-2026-44523 published to NVD.

References

• https://api.github.com/users/osageling
• https://github.com/osageling
• https://api.github.com/users/osageling/gists%7B/gist_id%7D
• https://api.github.com/users/osageling/repos
• https://avatars.githubusercontent.com/u/117736655?v=4
• https://api.github.com/users/osageling/events%7B/privacy%7D