Mnemosyne Sync Server Authentication Bypass via JWT Signature Verification Failure
A flaw in the Mnemosyne sync server's JWT implementation fails to verify HMAC-SHA256 signatures, allowing unauthenticated attackers to forge tokens and access or modify arbitrary user data.
CVE search metadata
CVE search record: CVE-2026-59163. Severity: critical. CVSS: 9.1. KEV: no. Brief: Mnemosyne Sync Server Authentication Bypass via JWT Signature Verification Failure. Brief link: https://feed.craftedsignal.io/briefs/2026-09-mnemosyne-auth-bypass/
The Mnemosyne sync server (up to v3.10.0) contains a critical authentication bypass vulnerability (CVE-2026-59163) resulting from incomplete JWT verification logic. While the server parses and decodes incoming JWT bearer tokens, it fails to perform cryptographic signature validation. Consequently, the server accepts any well-formed JWT token, regardless of the 'alg' header value or the integrity of the signature. An unauthenticated attacker can forge tokens containing arbitrary user IDs to gain unauthorized access to the sync service. This impact includes the ability to read sync state, push malicious data that corrupts local databases, and impersonate any user on the platform. Defenders should prioritize patching to v3.10.1 or restricting network access to the sync endpoint immediately.
Attack Chain
- Attacker identifies a network-reachable Mnemosyne sync server endpoint.
- Attacker crafts a malicious JWT header with 'alg: HS256' and a payload containing the target 'user_id'.
- Attacker base64url-encodes the header and payload components.