EUVD-2026-84171Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint (PR:N/AV:N) but AC:H because success needs an active SSO window and brute-forcing a 10^9 space in ten minutes; full account read/write is C:H/I:H, no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2.
AnalysisAI
Joplin Server instances prior to 3.7.2 expose an SSO login-code redemption endpoint (GET /api/login_with_code/:id) that is not protected by the limiterLoginBruteForce rate limiter, allowing an unauthenticated remote attacker to make unlimited guesses against a nine-digit authentication code whose lifetime is only ten minutes; a single correct guess yields a full session token granting read and write access to the victim's notes, notebooks, and account settings. Successful exploitation is constrained by timing and throughput: the attacker must target a user during an active SSO login, know the login id, and search roughly 10^9 possible codes inside a 600-second window (about 1.6 million requests per second for reliable coverage), so the flaw is only practical against servers reachable at high request rates. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Joplin Server (self-hosted sync server) versions prior to 3.7.2 with SSO/SAML authentication configured and in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 9.1 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) reflects an unauthenticated network-reachable flaw yielding full read/write compromise of a victim's account, and the confirmed root cause (CWE-307, missing limiterLoginBruteForce on GET /api/login_with_code/:id) is verified directly by the fix diff. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Joplin Server to version 3.7.2 or later, which is the release containing the fix; the change is delivered by PR https://github.com/laurent22/joplin/pull/15433 (commit fd8c1fb53f98f689e846dc164e39f307f09b684d) and documented in advisory GHSA-6vwc-4hrg-qp5h, so operators should track the v3.7.2 tag at https://github.com/laurent22/joplin/tree/v3.7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Joplin Server instances and upgrade any version prior to 3.7.2 to the vendor-released patch version 3.7.2; if immediate upgrade is not feasible, deploy a web application firewall (WAF) rule or reverse proxy configuration to rate-limit requests to /api/login_with_code/:id to no more than 5 requests per minute per IP. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into
Joplin is a free, open source note taking and to-do application. Rated critical severity (CVSS 9.6), this vulnerability
Joplin is a free, open source note taking and to-do application. Rated critical severity (CVSS 9.6), this vulnerability
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. Rated
Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into
Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. Rated medium severity (CVSS 6.1), this vulnerability i
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag. Rated
Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that parti
Joplin through 1.0.184 allows Arbitrary File Read via XSS. Rated medium severity (CVSS 5.4), this vulnerability is remot
The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in variou
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today