Mnemosyne
Monthly
Authentication bypass in the Mnemosyne sync server (mnemosyne-memory through v3.10.0) lets an unauthenticated, network-positioned attacker forge a JWT bearer token - including one using alg: none or signed with the wrong key - and impersonate any user_id to read that victim's synchronized memory state or push malicious state that corrupts their local database. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact, the flaw is remediated in v3.10.1, and a token-forging reproduction is published in the vendor's GHSA-xcw4-53cc-hv32 advisory, meaning publicly available exploit code exists, although no confirmed active exploitation has been reported. Practical exploitability is governed entirely by network exposure: deployments that bind the sync endpoint to localhost, front it with mTLS, or firewall it to trusted clients are not reachable and the vendor explicitly notes the issue 'is not exploitable against an unreachable endpoint,' reducing effective severity to High or Medium for those configurations.
Authentication bypass in the Mnemosyne sync server (mnemosyne-memory through v3.10.0) lets an unauthenticated, network-positioned attacker forge a JWT bearer token - including one using alg: none or signed with the wrong key - and impersonate any user_id to read that victim's synchronized memory state or push malicious state that corrupts their local database. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact, the flaw is remediated in v3.10.1, and a token-forging reproduction is published in the vendor's GHSA-xcw4-53cc-hv32 advisory, meaning publicly available exploit code exists, although no confirmed active exploitation has been reported. Practical exploitability is governed entirely by network exposure: deployments that bind the sync endpoint to localhost, front it with mTLS, or firewall it to trusted clients are not reachable and the vendor explicitly notes the issue 'is not exploitable against an unreachable endpoint,' reducing effective severity to High or Medium for those configurations.