CVE-2026-59163

Name of the Vulnerable Software and Affected Versions Mnemosyne versions prior to 3.10.1

Description The sync server uses JSON Web Tokens (JWT) to authenticate clients. An authentication check in mnemosyne/core/sync server.py parsed the JWT header and payload using base64 decoding but used library options that disabled signature verification. Consequently, the server accepted any well-formed token, including those with alg: none or tokens signed with an incorrect key. This allows an unauthenticated attacker to forge a JWT for any user id and impersonate users to access the /sync/status, /sync/push, and /sync/pull endpoints. This can lead to the unauthorized reading of sync state or the pushing of malicious data to corrupt a user's local database.

Recommendations Update to version 3.10.1. As a temporary mitigation, restrict network access to the sync server endpoint to trusted clients only using a firewall, a reverse proxy with mTLS, or a localhost bind with an SSH tunnel.