{"id":"EUVD-2026-30367","enisaUuid":"a7a18d0a-928b-3a4a-aa89-4d3847f3e9ce","description":"Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.","datePublished":"May 14, 2026, 6:42:58 PM","dateUpdated":"May 15, 2026, 2:55:08 PM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786\n","aliases":"CVE-2026-44523\nGHSA-q6mh-rqwh-g786\n","assigner":"GitHub_M","epss":0.15,"enisaIdProduct":[{"id":"3a6c4471-d327-3b30-abc7-632bfc84c33b","product":{"name":"note-mark","vendor":{"name":"enchant97"}},"product_version":"\u003c 0.19.4"}],"enisaIdVendor":[{"id":"bb2ed555-b05c-3af0-bc9c-f8dbf9f1e6cc","vendor":{"name":"enchant97"}}],"enisaIdVulnerability":[{"id":"6d278827-12bb-3bc6-8ff3-c4801b7bf3d7","vulnerability":{"id":"CVE-2026-44523","description":"Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.","datePublished":"May 14, 2026, 6:42:58 PM","dateUpdated":"May 15, 2026, 2:55:08 PM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786\n","enisa_id":"EUVD-2026-30367\n","assigner":"GitHub_M","epss":0.15,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"9a5926bf-184d-3b56-82a9-2be32cbd714b","product":{"name":"note-mark","vendor":{"name":"enchant97"}},"product_version":"\u003c 0.19.4"}],"vulnerabilityVendor":[{"id":"588ab77e-dab9-333b-8f2c-32266b78089f","vendor":{"name":"enchant97"}}]}},{"id":"840ff061-31de-3136-8bce-e4e3913c20c3","vulnerability":{"id":"GHSA-q6mh-rqwh-g786","description":"Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery","datePublished":"May 7, 2026, 9:08:10 PM","dateUpdated":"May 15, 2026, 11:45:05 PM","baseScore":0.0,"references":"https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44523\nhttps://github.com/enchant97/note-mark/commit/18b58775866776ed400c403dd0ccad68c1fa4802\nhttps://github.com/enchant97/note-mark\nhttps://github.com/enchant97/note-mark/releases/tag/v0.19.4\n","enisa_id":"EUVD-2026-30367\n","aliases":"GHSA-q6mh-rqwh-g786\nCVE-2026-44523\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}