The vulnerability exists in the Joplin Server GET /api/login_with_code/:id endpoint, which receives a nine‑digit SSO authentication code that expires after ten minutes. The endpoint does not enforce any login‑brute‑force limiting, so an unauthenticated attacker can repeatedly query the endpoint with guessed codes until a correct one is found. Upon a successful guess the attacker receives a full session token that grants read and write access to the user’s notes, notebooks, and account settings, effectively allowing the attacker to impersonate the user and tamper with private data.

Joplin Server versions earlier than 3.7.2 built by Laurent22 are affected. The issue is tied to the SSO login flow in these releases; any deployment that exposes the unprotected GET /api/login_with_code/:id endpoint is vulnerable.

With a CVSS score of 9.1 the vulnerability is considered critical. No EPSS score is available, but the lack of rate limiting and the short, ten‑minute code lifetime give an attacker a feasible attack window. The vulnerability is not listed in the CISA KEV catalog, yet the straightforward brute‑force attack path (unauthenticated request, unlimited guesses, obtain session token) presents a high exploitation likelihood for determined adversaries.