CVE-2026-46649: Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/loginwithcode/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joplin Serverto a version that resolves this vulnerability.Fixed in 3.7.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Joplin Server deployments running versions before 3.7.2 are affected. Exploitation targets users who are actively completing an SSO login.
What does an attacker need to exploit it?
The attacker does not need to authenticate, but must target the GET /api/login_with_code/:id endpoint during the ten-minute validity window of a user's nine-digit SSO authentication code. The endpoint permits unlimited code guesses because the login brute-force limiter is not applied.
What can an attacker obtain with a successful guess?
A correct code returns a full session token for the targeted user. That token permits access to and modification of the user's notes, notebooks, and account settings.
What is the remediation?
Upgrade Joplin Server to version 3.7.2, which fixes the missing rate limiting on the affected endpoint.