Joplin Server's Vulnerability in SSO Authentication Code Handling

CVE-2026-46649

What is CVE-2026-46649?

Joplin Server, an open-source note-taking application, has a security flaw in its SSO authentication code handling. Before version 3.7.2, the server's GET /api/login_with_code/:id endpoint accepted a nine-digit SSO authentication code that had a ten-minute validity period, but failed to implement adequate throttling for login attempts. As a result, an unauthenticated attacker could make unlimited guesses during a valid SSO session, potentially obtaining a full session token with access to the user's notes, notebooks, and account settings. This vulnerability has been addressed in version 3.7.2.

References