CVE-2026-59163Critical· 9.1▾ AbyssalPoC availableMnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. The server accepted any well-formed token regardless of the signature, including tokens with alg: none and tokens signed with the wrong key. The fix in v3.10.1 replaces the broken decode with a from-scratch HS256 verifier using only the Python standard library. For users who cannot upgrade immediately, restrict network access to the sync server endpoint to trusted clients only. Firewall, reverse proxy with mTLS, or localhost bind with SSH tunnel are all viable. The vulnerability is not exploitable against an unreachable endpoint.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
mnemosyne-memory <= 3.10.0Patched in:
mnemosyne-memory 3.10.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48526High· 7.4PyJWT is a JSON Web Token implementation in Python
CVE-2026-32597High· 7.5PyJWT is a JSON Web Token implementation in Python
CVE-2026-57122High· 8.6PraisonAI is a multi-agent teams system
CVE-2026-33487High· 7.5goxmlsig provides XML Digital Signatures implemented in Go
CVE-2026-1529High· 8.1A flaw was found in Keycloak
CVE-2026-28802Critical· 9.8Authlib is a Python library which builds OAuth and OpenID Connect servers