Mnemosyne Sync Server JWT Signature Bypass Allows Full Authentication Bypass (CVE-2026-59163)

What happened

A GitHub Security Advisory (GHSA-xcw4-53cc-hv32, CVE-2026-59163) discloses a critical authentication bypass in the Mnemosyne sync server. According to the advisory, the auth check in mnemosyne/core/sync_server.py decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures, so any well-formed token — including tokens using alg: none or signed with an arbitrary key — was accepted as valid. This affects all versions up to and including v3.10.0, and is fixed in v3.10.1 (commit a0b6b871). The reporter, Denis Hache, disclosed a working proof-of-concept requiring no credentials or secret knowledge.

Why it matters

The advisory rates this CVSS 3.1 9.1 (Critical) for network-reachable sync endpoints, dropping to High/Medium for localhost-only deployments. Per the report, an attacker with network access to /sync/status, /sync/push, or /sync/pull can forge a JWT for any user_id and fully impersonate that user — reading their sync state and pushing malicious data to corrupt their local database. In multi-user sync server deployments this also enables pivoting between accounts. The advisory notes no impact to availability, but confidentiality and integrity of sync data are fully compromised for the duration of exposure.

What defenders should do now

• Upgrade Mnemosyne sync server deployments to v3.10.1 immediately, prioritizing any instance reachable from untrusted networks.
• If immediate patching isn't possible, restrict network access to the sync server endpoint — firewall rules, a reverse proxy with mTLS, or binding to localhost with an SSH tunnel are the mitigations the advisory calls out. There is no other workaround; the vulnerability is not exploitable against an unreachable endpoint.
• Hunt for anomalous traffic to sync endpoints, particularly requests bearing JWTs with unusual structure (e.g., empty signature segment, alg: none headers, or tokens signed with a key that doesn't match your deployment's secret) and unexpected user_id access patterns across sessions or source IPs.
• Review sync server logs for evidence of cross-user data access or unexpected sync pushes predating the patch, since exploitation requires no prior credentials.

Developing intel

This is a same-day advisory publication (2026-09-18) and details are based solely on the GHSA writeup at this time; no independent verification of in-the-wild exploitation has been reported. We will update coverage if further exploitation activity or vendor guidance emerges. Full technical details, the reproduction steps, and the disclosure timeline are available in the original advisory: GHSA-xcw4-53cc-hv32.