Is CVE-2026-46649 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46649 being exploited in the wild.

How severe is CVE-2026-46649?

Informational severity, published 21 September 2026.

Is there a fix for CVE-2026-46649?

A patch was published on 2026-05-15: Fix merged in version 3.7.2 with rate limiter applied to SAML auth code endpoint Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46649 attacked?

It is attacked over the network.

Am I affected by CVE-2026-46649?

Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46649: Joplin Server authentication brute force in SSO endpoint

CVE-2026-46649 · Severity: info · Published 2026-09-21

Joplin Server is a note-taking application that stores sensitive user notes and account data. Attackers can bypass authentication on the SSO code exchange endpoint by making unlimited guesses at a nine-digit code, potentially gaining full access to a target user's notes, notebooks, and account settings without a password. This vulnerability affects versions before 3.7.2.

Technologies: Joplin Server. Vendors: Joplin.

Quick answers

Is CVE-2026-46649 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46649 being exploited in the wild.
How severe is CVE-2026-46649?: Informational severity, published 21 September 2026.
Which products and versions are affected?: Joplin Server before 3.7.2.
Is there a fix for CVE-2026-46649?: A patch was published on 2026-05-15: Fix merged in version 3.7.2 with rate limiter applied to SAML auth code endpoint Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46649 attacked?: It is attacked over the network.
Am I affected by CVE-2026-46649?: Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The GET /api/login_with_code/:id endpoint fails to apply the limiterLoginBruteForce rate limiter, allowing unauthenticated attackers to make unlimited authentication attempts. An attacker exploiting this during an active SSO login session can guess the temporary nine-digit authentication code (valid for ten minutes) and obtain a full session token. The vulnerability requires network access and targets the SSO authentication flow, affecting all users configured with SAML authentication.

Affected products

Joplin Server before 3.7.2

Timeline

2026-09-21: disclosed: CVE-2026-46649 published
2026-05-15: patched: Fix merged in version 3.7.2 with rate limiter applied to SAML auth code endpoint

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.