Critical, CVSS 9.1PyPIAmendedPublished
Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
CVE-2026-59163 · GHSA-xcw4-53cc-hv32
- Affected
- PyPI mnemosyne-memory <= 3.10.0
- Fixed in
- 3.10.1· Vendor fix available
- Issue
- The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1 Assumes the sync server endpoint is network-reachable. If your deployment is localhost-only, the score drops substantially and severity becomes High or Medium depending on local exposure. Confirm your threat model. Affected versions All mnemosyne versions exposing the sync server endpoint, up to and including v3.10.0. Patched versions v3.10.1 (commit a0b6b871 on branch security/jwt-signature-verification) Description The sync server uses JWT bearer tokens to authenticate clients. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with…
Recommended action: Upgrade to 3.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.