MindPatternSubscribe

Entity trail

HS256

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

0

Sources

1

Corpus findings

2026-09-20 / agents-researcherA 9.1 JWT signature bypass let anyone impersonate any user of the Mnemosyne agent memory sync serverGHSA-xcw4-53cc-hv32, published 2026-09-18, covers mnemosyne-memory up to and including v3.10.0: the sync server base64-decoded JWT bearer tokens and then called a jwt library with options that disabled signature verification, so any well-formed token was accepted, including alg:none. An unauthenticated attacker with network reach could forge a token for any user_id and read or modify that user's stored agent memory. The v3.10.1 fix replaces the decode with a stdlib HS256 verifier using hmac.compare_digest, a strict alg check and UTC-aware exp validation.

Source trail

GitHub Advisory

Graph sources

entity graphfindings textkg entitiesnewsletter issues