10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44523

CVE-2026-44523: Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44523

CVE-2026-44523:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/enchant97/note-mark/backend	go	< 0.0.0-20260501152247-18b587758667	0.0.0-20260501152247-18b587758667

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the application fails to enforce a minimum length on the JWT signing secret, allowing for weak secrets (less than 32 bytes for HS256) that are vulnerable to offline brute-force attacks. The analysis of the patch and source code identified a two-stage issue.

First, during application startup, the configuration is loaded. The function config.Base64Decoded.UnmarshalText decodes the JWT_SECRET from the environment but does not validate its length. This is orchestrated by config.AppConfig.ParseConfig, which, prior to the patch, lacked the logic to reject secrets shorter than 32 bytes.

Second, the weak secret is then used in core authentication routines. core.CreateAuthenticationToken uses the secret to sign new JWTs, and core.ParseAuthenticationToken uses it to verify incoming tokens. An attacker can capture a token created by the server, crack the weak secret offline, and then forge a new token for any user. The core.ParseAuthenticationToken function would then validate this forged token as legitimate, leading to a full account takeover.

The patch addresses the root cause by adding a validate:"gte=32" struct tag to the JWTSecret field in backend/config/config.go, which is enforced by the ParseConfig function. This ensures the application will not start with a weak secret.

Vulnerable functions

config.Base64Decoded.UnmarshalText

backend/config/utils.go

This function is responsible for decoding the base64-encoded `JWT_SECRET`. It does not perform any length validation, allowing a cryptographically weak secret to be loaded into the application's configuration. This is the entry point for the weak secret.

config.AppConfig.ParseConfig

backend/config/utils.go

This function orchestrates the loading of application configuration from environment variables. Prior to the patch, it did not enforce any length constraints on the `JWTSecret`, thereby failing to prevent weak secrets from being used.

core.CreateAuthenticationToken

backend/core/auth.go

This function signs a new JWT using the configured secret. If a weak secret is loaded due to the lack of validation, this function will generate tokens that an attacker can capture and use to perform an offline brute-force attack to recover the secret.

core.ParseAuthenticationToken

backend/core/auth.go

This function verifies incoming JWTs using the configured secret. During an attack, this function would be called to process a forged token. Because it uses the same weak secret for verification, it will accept the malicious token, granting the attacker unauthorized access.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.