3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40263

CVE-2026-40263: Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40263

CVE-2026-40263:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/enchant97/note-mark/backend	go	< 0.19.2-0.20260411145025-cf4c6f6acf70	0.19.2-0.20260411145025-cf4c6f6acf70

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic timing side-channel (CWE-208) in the authentication process. An attacker can distinguish between existing and non-existing usernames by measuring the server's response time. The analysis of the patch in commit cf4c6f6acf70b569d80396d323b067c00d45c034 confirms this. The primary vulnerable function is AuthService.GetAccessToken in backend/services/auth.go. Before the patch, this function would exit quickly if a user was not found in the database. If the user was found, it would proceed to call bcrypt.CompareHashAndPassword (via IsPasswordMatch), a computationally intensive operation. This created a significant and measurable timing difference. The fix involves modifying AuthService.GetAccessToken to execute a password comparison even when the user is not found. This is achieved by calling user.IsPasswordMatch(password) in the error-handling block. The IsPasswordMatch function in backend/db/models.go was also updated to ensure it always performs a bcrypt comparison, using a pre-calculated null hash if the user has no password, making the execution time constant and closing the timing leak.

Vulnerable functions

AuthService.GetAccessToken

backend/services/auth.go

This function handles the login request. The vulnerability lies in the fact that if a user is not found in the database, the function would previously return immediately. If the user was found, it would proceed to a computationally expensive password hash comparison. This difference in execution paths creates a timing side-channel that allows an attacker to determine if a username exists by measuring the server's response time. The patch adds a dummy password check for non-existent users to equalize the response time.

User.IsPasswordMatch

backend/db/models.go

This function was modified as part of the fix. The original implementation would return immediately if a user had no password set, creating a small timing difference. The main vulnerability, however, is in how this function is (or isn't) called by `AuthService.GetAccessToken`. The patched version of `IsPasswordMatch` ensures that a bcrypt comparison is always performed, even on a dummy hash, which is crucial for the fix implemented in `GetAccessToken` to work correctly and eliminate the timing leak.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.