CVE-2026-40263

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2.

• CWE-208

• https://github.com/enchant97/note-mark/commit/cf4c6f6acf70b569d80396d323b067c00d45c034
• https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp
• https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp

Published

Apr 17, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40258The Gramps Web API is a Python REST API for the genealogical…9.1
• CVE-2026-40259SiYuan is an open-source personal knowledge management syste…8.1
• CVE-2026-4026A security vulnerability has been identified in FlexNet Mana…8.7
• CVE-2026-40260pypdf is a free and open-source pure-python PDF library. In …5.3
• CVE-2026-40261Composer is a dependency manager for PHP. Versions 1.0 throu…8.8
• CVE-2026-40262Note Mark is an open-source note-taking application. In vers…8.7
• CVE-2026-40264OpenBao is an open source identity-based secrets management …2.7
• CVE-2026-40265Note Mark is an open-source note-taking application. In vers…5.9
• CVE-2026-4027A security vulnerability has been identified in FlexNet Mana…7.1
• CVE-2026-40272Improper Input Validation in the decode() function of the tr…7
• CVE-2026-40279BACnet Stack is a BACnet open source protocol stack C librar…3.7
• CVE-2026-40280Gotenberg is an API-based document conversion tool. In versi…7.5