The vulnerability resides in Mnemosyne's sync server where JWT tokens are parsed and signature verification is effectively disabled. As a result, any well‑formed token, including those with alg: none or signed with an incorrect key, is accepted. An attacker can hijack authentication, impersonate any user. This flaw provides a direct authentication bypass without needing valid credentials.

The flaw affects all releases of Mnemosyne earlier than v3.10.1. The product is distributed by AxDSan under the name mnemosyne. No additional version details are catalogued beyond the fact that versions < v3.10.1 are vulnerable.

The CVSS base score of 9.1 indicates critical severity. Because the sync server can be reached from anywhere in a network, exploitation does not require local privileges; the attacker only needs network access to the endpoint. Based on the description, the likely attack vector is remote network access to the sync server endpoint. The possibility of authentication bypass makes the vulnerability highly actionable, though no exploit is publicly noted in KEV. The absence of an EPSS score renders the current exploit probability uncertain, but the nature of the weakness (CWE-347) means that a crafted token is trivially generated.