{"vulnerability": "ghsa-xcw4-53cc-hv32", "sightings": [{"uuid": "f9d4cd3c-f882-447f-aa53-647c2d9a77be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xcw4-53cc-hv32", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117293336010618012", "content": "Go hack some Zero-cloud AI memory that works everywhere. SQLite-backed. One pure-Python dependency. bullshit.\nhttps://github.com/mnemosyne-oss/mnemosyne/security/advisories/GHSA-xcw4-53cc-hv32\nsev:CRIT 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n\nThe Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data.", "creation_timestamp": "2026-09-18T17:57:53.471663Z"}]}