CVE-2026-44523 - Vulnerability Analysis
CriticalCVSS: 10.0Last Updated: May 14, 2026
Note Mark - Weak Cryptography
Published: May 14, 2026Updated: May 14, 2026Remote Exploitable
Overview
Note Mark < 0.19.4 contains a weak cryptography vulnerability caused by lack of minimum length or entropy enforcement on JWT_SECRET configuration, letting attackers potentially compromise token security, exploit requires crafted JWT_SECRET.
Severity & Score
Severity: Critical
CVSS Score: 10.0
Impact
Attackers can exploit weak JWT secrets to compromise authentication tokens, potentially leading to unauthorized access.
Mitigation
Upgrade to version 0.19.4 or later.
Related Resources
Details
- CVE ID
- CVE-2026-44523
- Severity
- Critical
- CVSS Score
- 10.0
- Type
- weak_cryptography
- Status
- new
CWE
- CWE-326
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N