CVE-2026-46649 in Joplin
Summary
by MITRE • 09/22/2026
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Joplin Server prior to version 3.7.2 represents a critical authentication bypass mechanism rooted in the absence of rate limiting on a specific Single Sign-On (SSO) endpoint. The affected component is the GET /api/login_with_code/:id API route, which is designed to validate temporary SSO authentication codes issued during user login flows. These codes are typically short-lived, possessing a ten-minute lifetime and consisting of nine digits, intended to provide a secure yet convenient method for users to authenticate without entering passwords repeatedly. However, the implementation failed to enforce brute-force protection mechanisms such as limiterLoginBruteForce on this specific endpoint. This oversight creates a significant security gap where an unauthenticated attacker can interact with the login mechanism without restriction, effectively bypassing standard account lockout or throttling policies that protect other authentication vectors like password-based logins.
From a technical perspective, the flaw allows for unlimited guessing attempts against the nine-digit SSO code within its ten-minute validity window. Given that a nine-digit numeric code offers approximately one billion possible combinations, an attacker can employ automated scripts to iterate through these possibilities rapidly. Since there is no rate limiting or exponential backoff mechanism in place, the server processes each request independently without tracking failed attempts from specific source IPs or user agents. Once a correct code is guessed and submitted, the system issues a full session token. This token grants the attacker complete administrative access to the victim's account, including the ability to read sensitive notes, modify notebooks, alter account settings, and potentially exfiltrate data stored within the Joplin ecosystem. The lack of additional verification steps after successful code validation exacerbates the severity, as no secondary factor or behavioral analysis is employed to confirm legitimate user activity.
The operational impact of this vulnerability extends beyond simple unauthorized access. Because SSO codes are often used in environments where users expect seamless authentication, such as corporate intranets or integrated workflows, attackers can target individuals during active login sessions with high precision. The ability to modify account settings means an attacker could change recovery email addresses or disable two-factor authentication if applicable, leading to long-term persistence and further compromise of the user's digital identity. Furthermore, since Joplin is often used for storing personal notes, business documents, and sensitive information, the confidentiality and integrity aspects of the CIA triad are severely compromised. The vulnerability aligns with CWE-307 Improper Restriction of Excessive Authentication Attempts, as it fails to limit the number of authentication attempts allowed within a given timeframe. Additionally, from an ATT&CK perspective, this behavior corresponds to T1110 Brute Force and specifically T1078 Valid Accounts, where attackers leverage stolen or guessed credentials to gain initial access and maintain persistence within the target environment.
Mitigation strategies primarily involve upgrading Joplin Server to version 3.7.2 or later, which implements the necessary rate-limiting controls on the login_with_code endpoint. For organizations unable to upgrade immediately due to operational constraints, network-level mitigations can be employed as a temporary countermeasure. Implementing Web Application Firewall (WAF) rules that detect and block excessive requests from single IP addresses targeting this specific API path can help mitigate brute-force attempts. Additionally, monitoring logs for unusual patterns of authentication failures or successful logins followed by immediate account modifications can aid in early detection. It is also recommended to review SSO configurations to ensure that session tokens are short-lived and tied strictly to the user's current context, minimizing the window of opportunity for an attacker who has successfully guessed a code. Regular security audits focusing on API endpoint protections should be conducted to identify similar gaps in other authentication flows within the application infrastructure.