CVE-2026-46649: Joplin Server: SSO code brute force yields session takeover

CRITICALPoC AVAILABLECISA: ATTEND

Published September 21, 2026

CISO Take

Joplin Server before 3.7.2 does not apply its brute-force limiter to the SSO login-with-code endpoint, so an unauthenticated attacker can make unlimited guesses at a nine-digit code during its ten-minute lifetime. A correct guess returns a full session token with read and write access to the victim's notes, notebooks, and account settings. Joplin is a general note-taking tool rather than an AI platform, so the AI relevance is indirect: teams often keep prompts, API keys, model credentials, and internal runbooks in notes. Exploitation is plausible, since a public PoC exists and SSVC says ATTEND, but EPSS is low at 0.005 (59th percentile) and it is not in CISA KEV. Upgrade self-hosted Joplin Server to 3.7.2 or later, and review access logs for bursts of requests to /api/login_with_code/ if SSO is enabled.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Rated critical by the vendor, but real-world risk is moderate. The attack is network-reachable and needs no credentials, but it requires a user to have an SSO login in progress and a guessing window of ten minutes. The code space is 10^9 (nine digits), so success depends on request throughput and any upstream rate limiting. Exposure is limited to internet-reachable Joplin Server instances with SSO enabled. EPSS is low and there is no KEV listing. A public PoC and an SSVC decision of ATTEND justify prompt patching. The AI/ML impact is indirect, through sensitive data stored in notes.

How does the attack unfold?

Initial Access

Attacker identifies an exposed Joplin Server with SSO enabled and an in-progress SSO login ID.

AML.T0049

Credential Brute Force

Attacker sends unlimited guesses to /api/login_with_code/:id because the brute-force limiter is not applied, until the nine-digit code matches.

AML.T0091.000

Collection

The returned session token is used to read notes, notebooks, and settings, including any stored secrets.

AML.T0055

Impact

Attacker modifies or deletes notes and changes account settings, and reuses harvested credentials against other services.

Initial Access

Attacker identifies an exposed Joplin Server with SSO enabled and an in-progress SSO login ID.

AML.T0049

Credential Brute Force

Attacker sends unlimited guesses to /api/login_with_code/:id because the brute-force limiter is not applied, until the nine-digit code matches.

AML.T0091.000

Collection

The returned session token is used to read notes, notebooks, and settings, including any stored secrets.

AML.T0055

Impact

Attacker modifies or deletes notes and changes account settings, and reuses harvested credentials against other services.

How severe is it?

CVSS 3.1

N/A

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

5 steps

Upgrade Joplin Server to 3.7.2 or later (fix in PR 15433, commit fd8c1fb).
Until patched, disable SSO login or restrict the server to a VPN or an IP allowlist.
Add rate limiting at the reverse proxy (nginx, Caddy, WAF) for /api/login_with_code/*, for example a few requests per minute per IP.
Monitor logs for many requests to the login_with_code endpoint from one source, or many 4xx responses followed by a 200.
After patching, rotate any API keys, tokens, or credentials stored in notes if suspicious access is found, and invalidate active sessions.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAPIAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoringA.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responding to previously unknown risks and vulnerabilities

Frequently Asked Questions

What is CVE-2026-46649?

Is CVE-2026-46649 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-46649, increasing the risk of exploitation.

How to fix CVE-2026-46649?

1. Upgrade Joplin Server to 3.7.2 or later (fix in PR 15433, commit fd8c1fb). 2. Until patched, disable SSO login or restrict the server to a VPN or an IP allowlist. 3. Add rate limiting at the reverse proxy (nginx, Caddy, WAF) for /api/login_with_code/*, for example a few requests per minute per IP. 4. Monitor logs for many requests to the login_with_code endpoint from one source, or many 4xx responses followed by a 200. 5. After patching, rotate any API keys, tokens, or credentials stored in notes if suspicious access is found, and invalidate active sessions.

What systems are affected by CVE-2026-46649?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted note-taking and knowledge management servers, SSO-integrated internal tooling, Developer and ML team documentation stores.

What is the CVSS score for CVE-2026-46649?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Self-hosted note-taking and knowledge management serversSSO-integrated internal toolingDeveloper and ML team documentation stores

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0091.000Application Access Token

Compliance Controls Affected

ISO 42001: A.6.2.6, A.7.4

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2.

Exploitation Scenario

An attacker finds a self-hosted Joplin Server used by an ML team and identifies when a user starts an SSO login, for example by timing or by triggering a login flow and learning the login ID. They script high-volume requests to GET /api/login_with_code/:id with sequential or random nine-digit codes inside the ten-minute window. A correct guess returns a session token. The attacker then reads notes containing LLM API keys, prompt engineering notes, and internal security findings, and may edit notes to plant misleading instructions or links. They then reuse the harvested credentials against cloud AI services.

Weaknesses (CWE)

CWE-307Improper Restriction of Excessive Authentication AttemptsPrimary CWE-307Improper Restriction of Excessive Authentication Attempts

CWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

[Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE corpus.