Authentication Flaw in Synchro Server of Mnemosyne by Mnemosyne Team

CVE-2026-59163

What is CVE-2026-59163?

The Mnemosyne memory layer for AI agents has a significant vulnerability due to improper authentication checks in its sync server component. Prior to version 3.10.1, the server allowed the acceptance of any well-formed JWT token, including those lacking proper signature verification. This flaw enabled attackers to use tokens without valid signatures, potentially compromising user sessions and data integrity. Following the release of version 3.10.1, the vulnerability has been patched by implementing a new HS256 verification method using Python's standard library. Users unable to upgrade are advised to restrict access to the sync server endpoint to trusted clients by employing firewalls, reverse proxies, or SSH tunnels to enhance security.

References