CVE-2026-44523: CWE-326: Inadequate Encryption Strength in enchant97 note-mark
CVE-2026-44523 affects the open-source note-taking application Note Mark prior to version 0.19.4. The vulnerability arises because the application does not enforce a minimum length or entropy requirement on the JWT_SECRET configuration value, allowing very weak secrets, including those as short as one byte. This inadequate encryption strength can compromise confidentiality and integrity of JWT tokens. The issue is fixed in version 0.19.4. The vulnerability has a critical CVSS score of 10. No known exploits are reported in the wild.
AI Analysis
Technical Summary
Note Mark versions before 0.19.4 accept any base64-decodable JWT_SECRET regardless of size or entropy, including extremely short secrets. This violates secure cryptographic practices by allowing weak encryption keys, which can lead to compromise of JWT tokens used for authentication or authorization. The vulnerability is identified as CWE-326 (Inadequate Encryption Strength) and CWE-345 (Insufficient Verification of Data Authenticity). The flaw is resolved in version 0.19.4 by enforcing minimum length and entropy requirements on the JWT_SECRET.
Potential Impact
An attacker could exploit weak JWT secrets to forge or tamper with JSON Web Tokens, potentially gaining unauthorized access or escalating privileges. The vulnerability impacts confidentiality and integrity of authentication tokens but does not affect availability. The CVSS score of 10 reflects the critical nature of this risk.
Mitigation Recommendations
Upgrade Note Mark to version 0.19.4 or later, where the JWT_SECRET configuration enforces minimum length and entropy requirements, mitigating the risk of weak secrets. Since no official patch link or vendor advisory is provided, users should verify the upgrade from the official project repository or release notes. Patch status is not explicitly confirmed beyond the version fix; check the vendor source for current remediation guidance.
CVE-2026-44523: CWE-326: Inadequate Encryption Strength in enchant97 note-mark
Description
CVE-2026-44523 affects the open-source note-taking application Note Mark prior to version 0.19.4. The vulnerability arises because the application does not enforce a minimum length or entropy requirement on the JWT_SECRET configuration value, allowing very weak secrets, including those as short as one byte. This inadequate encryption strength can compromise confidentiality and integrity of JWT tokens. The issue is fixed in version 0.19.4. The vulnerability has a critical CVSS score of 10. No known exploits are reported in the wild.
CVSS v3.1
Score 10.0critical
Affected software
pkg:github/enchant97/note-markRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Note Mark versions before 0.19.4 accept any base64-decodable JWT_SECRET regardless of size or entropy, including extremely short secrets. This violates secure cryptographic practices by allowing weak encryption keys, which can lead to compromise of JWT tokens used for authentication or authorization. The vulnerability is identified as CWE-326 (Inadequate Encryption Strength) and CWE-345 (Insufficient Verification of Data Authenticity). The flaw is resolved in version 0.19.4 by enforcing minimum length and entropy requirements on the JWT_SECRET.
Potential Impact
An attacker could exploit weak JWT secrets to forge or tamper with JSON Web Tokens, potentially gaining unauthorized access or escalating privileges. The vulnerability impacts confidentiality and integrity of authentication tokens but does not affect availability. The CVSS score of 10 reflects the critical nature of this risk.
Mitigation Recommendations
Upgrade Note Mark to version 0.19.4 or later, where the JWT_SECRET configuration enforces minimum length and entropy requirements, mitigating the risk of weak secrets. Since no official patch link or vendor advisory is provided, users should verify the upgrade from the official project repository or release notes. Patch status is not explicitly confirmed beyond the version fix; check the vendor source for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T19:38:10.566Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a06e21bec166c07b0e8f079
Added to database: 05/15/2026, 09:06:35 UTC
Last enriched: 05/22/2026, 15:37:08 UTC
Last updated: 07/02/2026, 20:51:20 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.