Executive brief
Mnemosyne is a flashcard and study aid application with a sync server that allows users to synchronize their learning data across devices. The sync server fails to verify JWT authentication tokens, allowing an attacker without credentials to impersonate any user, read their learning data, and corrupt it by pushing malicious updates. This grants complete access to sensitive personal study information.
Technical details
The Mnemosyne sync server implements JWT bearer token authentication but fails to verify the HMAC-SHA256 signature on tokens, accepting any well-formed token including those with invalid signatures or the "none" algorithm. The vulnerability exists in mnemosyne/core/sync_server.py where the JWT library is called with signature verification effectively disabled. An unauthenticated attacker with network access can forge arbitrary JWT tokens for any user_id and authenticate to /sync/status, /sync/push, and /sync/pull endpoints. The attacker can read and modify the victim's sync data without any credentials or knowledge of the signing key. The fix in v3.10.1 implements a strict HS256-only verifier using constant-time comparison and proper expiration validation.
Affected products
- Mnemosyne Mnemosyne all versions up to and including v3.10.0
Timeline
- 2026-06-13: disclosed: Initial report received from Denis Hache via private channel
- 2026-09-18: patched: v3.10.1 released with fix (commit a0b6b871)
- 2026-09-18: advisory: GHSA-xcw4-53cc-hv32 published