CVE-2026-44523
Critical
Description
Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.
SeverityCritical
CVSS10.0
Exploit probability—
ProductGithub.com/enchant97/note-mark/backend
PublishedMay 14, 2026
First seenMay 14, 2026
Weakness typeCWE-326CWE-326CWE-345CWE-345
How to fix
Update
- github.com/enchant97/note-mark/backend0.0.0-20260501152247-18b587758667 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/enchant97/note-mark/backendGo | v < 0.0.0-20260501152247-18b587758667 | 0.0.0-20260501152247-18b587758667 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.