Note Mark versions prior to 0.19.2 have a timing side-channel vulnerability at the login endpoint. When a login attempt is made, the application performs bcrypt password verification only if the username exists. For nonexistent usernames, the endpoint returns immediately without bcrypt processing. This difference in response time can be measured by an attacker to determine valid usernames, facilitating targeted credential attacks. The vulnerability is identified as CWE-208 (Observable Timing Discrepancy). The issue is resolved in version 0.19.2.

The vulnerability allows unauthenticated attackers to enumerate valid usernames by exploiting timing differences in the login process. This information disclosure is limited to username validity and does not directly compromise password confidentiality, data integrity, or availability. The CVSS score of 3.7 reflects a low severity impact focused on information disclosure.

Upgrade Note Mark to version 0.19.2 or later, where this timing discrepancy vulnerability has been fixed. No other mitigation is required as the issue is resolved in the updated version.