Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-46649— Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint

Quick assessment

Affected
laurent22 joplin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without appl

CVSS 9.1 · Critical EPSS 0.38% · P32

Affected Version Matrix 1

VendorProduct Version RangeStatus
laurent22 joplin < 3.7.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-46649

Vulnerability Information

Shenlong is analyzing...

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
laurent22 joplin < 3.7.2 -

II. Public POCs for CVE-2026-46649

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-46649

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-46649 (2)

Other References for CVE-2026-46649 (2)

Same Patch Batch · laurent22 · 2026-09-21 · 11 CVEs total

CVE-2026-55105 7.7 HIGH Joplin: Fountain embeds allow arbitrary script execution in published notes and the note v
CVE-2026-59814 7.6 HIGH Joplin: Stored XSS via inline-served note attachment on published shares
CVE-2026-55210 7.4 HIGH Joplin: SAML SSO account takeover via email-based account linking (missing is_external che
CVE-2026-49450 7.1 HIGH Joplin desktop Windows auto-updater accepts signed installer from any publisher because ap
CVE-2026-49453 7.0 HIGH Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource
CVE-2026-55179 6.5 MEDIUM Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its int
CVE-2026-46650 4.4 MEDIUM Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
CVE-2026-59816 4.3 MEDIUM Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash
CVE-2026-59815 4.3 MEDIUM Joplin: Pending share recipients can write items into shared folders before accepting invi
CVE-2026-49449 2.5 LOW Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft

IV. Related Vulnerabilities

Same product: joplin
Same vendor: laurent22
Same weakness: CWE-307

V. Comments for CVE-2026-46649

No comments yet

Leave a comment