Note Mark stores session identifiers as JSON Web Tokens encrypted with a user‑defined JWT_SECRET. Prior to version 0.19.4 the secret configuration accepts any base64‑decodable value, including secrets as small as one byte. The lack of a minimum length or entropy requirement allows an adversary to guess or brute‑force the secret. It is inferred that an attacker who discovers a valid secret can generate tokens that authenticate as any user, thereby granting full access to application data. This weakness is characterized by CWE-326 (Improper Key Size or Strength) and CWE-345 (Missing Authentication).

All releases of Note Mark from earlier than 0.19.4 are affected. The vendor is enchant97:note‑mark. Any deployment that uses the default or a user‑defined short JWT_SECRET in those pre‑0.19.4 builds is vulnerable.

The CVSS score of 10 flags this flaw as critically severe. EPSS is not available, but the absence of protection against brute force attempts implies a realistic exploitation window. The vulnerability is not listed in CISA KEV. It is inferred that the attack vector involves forging JWT tokens by exploiting the weak secret enforcement, leading to unrestricted account takeover.