https://vulnerability.circl.lu/sightings/feed 2026-09-19T15:52:33.823062+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/12a5a7bc-4d1a-4858-9f7f-18bfa97d337f/export 2026-09-19T15:52:33.828266+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "12a5a7bc-4d1a-4858-9f7f-18bfa97d337f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xcw4-53cc-hv32", "type": "seen", "source": "https://gist.github.com/alon710/d69b517a6b95a915db94a084d6dcfcda", "content": "# CVE-2026-59163: CVE-2026-59163: Critical JWT Authentication Bypass in Mnemosyne Sync Server\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59163\n\n## Summary\nCVE-2026-59163 is a critical authentication bypass vulnerability in the Mnemosyne sync server. In versions prior to v3.10.1, the server's authentication logic decoded incoming JSON Web Tokens (JWT) but completely skipped cryptographic signature verification. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, impersonate arbitrary users, read synchronized AI agent states, or write malicious database updates.\n\n## TL;DR\nAn authentication bypass vulnerability in the Mnemosyne sync server allows remote attackers to spoof JWTs and gain full unauthorized access by omitting signature verification.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-347\n- **Attack Vector**: Network (AV:N)\n- **CVSS**: 9.1 (Critical)\n- **EPSS**: Not Available\n- **Impact**: Full Authentication Bypass\n- **Exploit Status**: PoC (Trivial to exploit)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mnemosyne Sync Server\n- **Mnemosyne**: < 3.10.1 (Fixed in: `3.10.1`)\n\n## Mitigation\n\n- Upgrade Mnemosyne to v3.10.1 or later\n- Enforce network-level access control\n- Bind the sync server to localhost\n- Deploy a reverse proxy with mTLS\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade mnemosyne-memory==3.10.1' to apply the official patch.\n2. Audit configuration files to ensure 'jwt_secret' is populated with a high-entropy string.\n3. Configure firewall rules to block untrusted incoming connections to the sync port.\n4. Implement NGINX/HAProxy reverse proxy to enforce network-level authentication.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/mnemosyne-oss/mnemosyne/security/advisories/GHSA-xcw4-53cc-hv32)\n- [Vulnerability Fix Commit](https://github.com/mnemosyne-oss/mnemosyne/commit/a0b6b8711a1a485304971710dc3571e29ff9dbeb)\n- [Raw Code Patch File Reference](https://github.com/mnemosyne-oss/mnemosyne/commit/a0b6b8711a1a485304971710dc3571e29ff9dbeb.patch)\n- [Vulnerability Release Pull Request](https://github.com/mnemosyne-oss/mnemosyne/pull/373)\n- [Official Release Announcement (v3.10.1)](https://github.com/mnemosyne-oss/mnemosyne/releases/tag/v3.10.1)\n- [CVE Record Database Reference](https://www.cve.org/CVERecord?id=CVE-2026-59163)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59163) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T03:31:29.760629Z"} 2026-09-19T03:31:29.760629+00:00 https://vulnerability.circl.lu/sighting/f9d4cd3c-f882-447f-aa53-647c2d9a77be/export 2026-09-19T15:52:33.829965+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f9d4cd3c-f882-447f-aa53-647c2d9a77be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xcw4-53cc-hv32", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117293336010618012", "content": "Go hack some Zero-cloud AI memory that works everywhere. SQLite-backed. One pure-Python dependency. bullshit.\nhttps://github.com/mnemosyne-oss/mnemosyne/security/advisories/GHSA-xcw4-53cc-hv32\nsev:CRIT 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n\nThe Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data.", "creation_timestamp": "2026-09-18T17:57:53.471663Z"} 2026-09-18T17:57:53.471663+00:00