CVE-2026-59163: Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
The Mnemosyne sync server’s authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data.
Severity: Critical
CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1
Assumes the sync server endpoint is network-reachable. If your deployment is localhost-only, the score drops substantially and severity becomes High or Medium depending on local exposure. Confirm your threat model.
References
- github.com/AxDSan/mnemosyne/security/advisories/GHSA-xcw4-53cc-hv32
- github.com/advisories/GHSA-xcw4-53cc-hv32
- github.com/mnemosyne-oss/mnemosyne/commit/a0b6b8711a1a485304971710dc3571e29ff9dbeb
- github.com/mnemosyne-oss/mnemosyne/pull/373
- github.com/mnemosyne-oss/mnemosyne/releases/tag/v3.10.1
- nvd.nist.gov/vuln/detail/CVE-2026-59163
Code Behaviors & Features
Detect and mitigate CVE-2026-59163 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →