Note Mark versions prior to 0.19.2 have a timing side-channel vulnerability (CWE-208) in the login process. When a login attempt is made, the system performs bcrypt password verification only if the username exists; if the username does not exist, the response returns immediately. This timing difference can be measured by an attacker to enumerate valid usernames, facilitating targeted credential attacks. The vulnerability is addressed in version 0.19.2.

The vulnerability allows unauthenticated attackers to determine valid usernames by measuring response times from the login endpoint. This information disclosure can aid attackers in focusing credential-based attacks on valid accounts. The confidentiality impact is low, with no direct impact on integrity or availability. There are no known exploits in the wild.

Upgrade Note Mark to version 0.19.2 or later, where this timing discrepancy issue has been fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. No additional mitigation steps are indicated.