CVE-2026-40263 LOW

CVE-2026-40263: Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

Vendor Enchant97
Product note-mark
Weakness CWE-208
Published April 16, 2026
Last update April 17, 2026
View on NVD All CVEs

CVSS base score

3.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2.

Key dates

02Disclosure timeline

April 16, 2026 CVE published
April 17, 2026 Record updated