{"id":"CVE-2026-40263","sourceIdentifier":"security-advisories@github.com","published":"2026-04-17T01:17:40.137","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2."},{"lang":"es","value":"Note Mark es una aplicación de código abierto para tomar notas. En las versiones 0.19.1 y anteriores, el endpoint de inicio de sesión realiza la verificación de contraseña bcrypt solo cuando el nombre de usuario proporcionado existe, devolviendo inmediatamente para nombres de usuario inexistentes. Esta discrepancia de tiempo permite a atacantes no autenticados enumerar nombres de usuario válidos midiendo los tiempos de respuesta, lo que permite ataques de credenciales dirigidos. Este problema ha sido solucionado en la versión 0.19.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"enchant97","product":"note-mark","versions":[{"version":"< 0.19.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-17T12:23:37.345690Z","id":"CVE-2026-40263","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-208"}]}],"references":[{"url":"https://github.com/enchant97/note-mark/commit/cf4c6f6acf70b569d80396d323b067c00d45c034","source":"security-advisories@github.com"},{"url":"https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp","source":"security-advisories@github.com"},{"url":"https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}