EUVD-2026-291809

fkie_cve-2026-40263

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the supplied username exists, returning immediately for nonexistent usernames. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames by measuring response times, enabling targeted credential attacks. This issue has been fixed in version 0.19.2.

GHSA-w6m9-39cv-2fwp — Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

Affected: Go: github.com/enchant97/note-mark/backend

### Summary A timing side-channel in the login endpoint allows unauthenticated attackers to determine whether a username exists by measuring response time differences. Requests for valid usernames take noticeably longer because the server performs bcrypt password verification, while requests for nonexistent usernames return much faster. This enables reliable remote username enumeration and increases the risk of targeted credential attacks.

### Details The issue affects the login endpoint:

- `POST /api/auth/token`

The root cause is that authentication processing takes different code paths depending on whether the supplied username exists. When the username is found, the server performs `bcrypt.CompareHashAndPassword`, which adds substantial latency. When the username does not exist, the server returns immediately without performing an equivalent bcrypt operation.

Vulnerable flow:

```go user, err := db.Where("username = ?", username).First(&user) if err != nil { return ErrUnauthorized } err = bcrypt.CompareHashAndPassword(user.PasswordHash, []byte(password)) ```

This creates a measurable timing discrepancy between: - **existing username + wrong password** requests, which incur bcrypt cost - **nonexistent username + any password** requests, which avoid bcrypt entirely

Because no constant-time equalization is performed, the endpoint leaks account existence through timing behavior.

The measurements provided show a large and consistent gap between the two cases across…

Most recent entries from all

EUVD-2026-291809

fkie_cve-2026-40263

GHSA-w6m9-39cv-2fwp — Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel