CVE-2026-44523: Note Mark: Weak JWT Secret Enables Token Forgery and Account Takeover
Note Mark, an open-source note-taking application, does not enforce a minimum length or entropy on its JWT_SECRET setting before version 0.19.4. The record reports that a secret as short as 1 byte is accepted, which could allow token forgery and full account takeover. The record fixes the issue in 0.19.4 and does not list it in CISA KEV.
Overview
Note Mark is an open-source note-taking application. According to the record, versions before 0.19.4 do not enforce any minimum length or entropy on the JWT_SECRET setting and accept any base64-decodable value, even one byte long. The weakness is classified as CWE-326 (Inadequate Encryption Strength).
Impact
The record scores the issue at 10 (critical) under CVSS 3.1, with a network attack vector, low complexity, no privileges or user interaction required, and high confidentiality and integrity impact. The record associates the issue with full account takeover through token forgery. Because the signing key is the weak secret, a party able to recover or guess it could produce tokens the application would accept. This link is an inference from the weakness type and the scoring data.
Affected products and versions
- Enchant97 Note-mark, versions below 0.19.4, as stated in the record.
Exploitation status
The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the record. No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is set to poc, which the record reports as proof-of-concept level status. The record provides no details of any public proof of concept. The EPSS probability is 0.00163 with a percentile of 0.05071.
Remediation and mitigation
- Upgrade Note Mark to version 0.19.4 or later, as stated in the record.
- After upgrading, review the JWT_SECRET setting and replace any short or low-entropy value with a long, randomly generated secret stored securely.
- Consider invalidating sessions or tokens issued under a previously weak secret, since such tokens may have been forged. This is a recommendation, not a fact stated in the record.
- Restrict who can read or modify deployment configuration.
Detection guidance
- Check deployed configurations for JWT_SECRET values that are very short or have low entropy.
- Review authentication logs for sessions that do not match normal logins or show unusual account activity.
- Verify the running Note Mark version on every instance.
Limitations of the available information
The fixes list in the record is empty, so the fixed version is known only from the description text. The record provides no proof of concept, exploitation timeline or evidence of abuse. The advisory details beyond the reference URL were not available for this analysis.
Frequently asked questions
Which version fixes this issue?
The record states the issue is fixed in version 0.19.4. Upgrading to that version or later is the recommended remediation.
Is this vulnerability being exploited in the wild?
The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.