Mnemosyne versions before 3.10.1 contain a flaw in the authentication check within mnemosyne/core/sync_server.py where JWT tokens are parsed using base64 decoding and then passed to a JWT library call with options that disable signature verification. This allows acceptance of any well-formed JWT token regardless of signature, including tokens with 'alg: none' or those signed with incorrect keys. The vulnerability is addressed in version 3.10.1 by implementing a from-scratch HS256 signature verifier using only the Python standard library. For users unable to upgrade immediately, network access to the sync server endpoint should be restricted to trusted clients via firewall rules, reverse proxy with mTLS, or localhost binding with SSH tunneling. Exploitation is not possible if the endpoint is not reachable.

An attacker can bypass authentication by presenting any well-formed JWT token, including those with no signature or invalid signatures, potentially gaining unauthorized access to the sync server. This leads to a complete compromise of confidentiality and integrity of the affected service. Availability is not impacted. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

A fix is available in mnemosyne version 3.10.1 which implements proper JWT signature verification. Users should upgrade to version 3.10.1 or later. For those unable to upgrade immediately, restrict network access to the sync server endpoint to trusted clients only using firewall rules, reverse proxy with mutual TLS authentication, or binding the service to localhost with SSH tunneling. The vulnerability is not exploitable if the endpoint is unreachable.