CVE-2026-40263lowCWE-208

CVE-2026-40263: falha de baixa gravidade em enchant97 note-mark

Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar note-mark+ Monitorar github.com/enchant97/note-mark/backend

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.7epss 0.3%
Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
enchant97 · note-mark
CVEs relacionadas — enchant97 note-mark

No mesmo produto, das mais perigosas para as menos.

CVE-2024-41819HIGHNote Mark has a stored XSS in the note link href attributeEPSS 0.8%CVE-2026-44522HIGHNote Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code ExecutionEPSS 0.6%CVE-2026-50553HIGHNote Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)EPSS 0.5%CVE-2026-40265MEDIUMNote Mark has Broken Access Control on Asset DownloadEPSS 0.4%CVE-2026-50554MEDIUMNote Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-markEPSS 0.4%CVE-2026-41571CRITICALNote Mark: OIDC-registered users authenticated by submitting password "null"EPSS 0.4%