mnemosyne

Mnemosyne is a generic Windows-based memory scraping tool. It scans a process memory space for a search string or regex unicode and ascii then if found, spits these out either to stdout, a file or a socket to a remote listener. The utility is useful for memory scraping a process, as a...

Mnemosyne

Mnemosyne My personal infosec memo Fun fact The name of this project comes from the Greek goddess of memory: Mnemosyne. Moreover and regarding our story, it is interesting to note that, it's the origin of the word memory. Usage Mnemosyne is publicly available on the sub-domain of the same name of...

PYSEC-2026-4106 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

SummaryThe Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data.Severity: CriticalCVSS 3.1:...

PT-2026-105855

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...

CVE-2026-59163

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

CVE-2026-59163 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

CVE-2026-59163

Mnemosyne is a memory layer for AI agents. Prior to v3.10.1 , the authentication check in mnemosyne/core/sync_server.py parsed the JWT header and payload via base64 decoding and then passed the token to a jwt library call with options that effectively disabled signature verification , allowing th...

CVE-2026-59163 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

CVE-2026-59163 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

EUVD-2026-83263

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

GHSA-XCW4-53CC-HV32 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...

CVE-2026-59163: Improper Verification of Cryptographic Signature

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

PT-2026-95576

Name of the Vulnerable Software and Affected Versions Mnemosyne versions prior to 3.10.1 Description The sync server uses JSON Web Tokens JWT to authenticate clients. An authentication check in mnemosyne/core/sync server.py parsed the JWT header and payload using base64 decoding but used library...

ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-context-engineering-spring-boot-starter (>=0.5.0, <=0.9.2) +1079 more potentially affected by CVE-2026-86071 via com.github.junrar:junrar (>=0.7, <=7.6.0)

com.github.junrar:junrar MAVEN version =0.7, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =0.9.2 - ai.mattmann.mnemosyne:cas-crawler 1.11.0 - ai.mattmann.mnemosyne:cas-filemgr 1.11.0 - ai.mattmann.mnemosyne:cas-pge 1.11.0 - ai.mattmann.mnemosyne:cas-product 1.11...

be.fluid-it.reactive-microservice.bundle:bootique-vertx (0.1-8), be.fluid-it.reactive-microservice.bundle:reactive-microservice-bundle-core (0.1-8) +467 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.5.0)

io.vertx:vertx-core MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - be.fluid-it.reactive-microservice.bundle:bootique-vertx 0.1-8 -...

ai.kognition.pilecv4j:lib-ffmpeg (0.16), ai.kognition.pilecv4j:lib-image (0.16) +1701 more potentially affected by CVE-2025-27553 via org.apache.commons:commons-vfs2 (>=2.0, <=2.9.0)

org.apache.commons:commons-vfs2 MAVEN version =2.0, =0.16, =v0.2.4, =0.0.4, =0.0.5 and more Source cves: CVE-2025-27553 Source advisory: OSV:GHSA-9Q4X-FR4M-JP86...

ai.mattmann.mnemosyne:cas-product (>=1.11.0, <=1.13.8), ai.mattmann.mnemosyne:pcs-services (>=1.12.0, <=1.13.8) +662 more potentially affected by CVE-2016-6812 via org.apache.cxf:cxf-core (>=3.1.0, <=3.1.8)

org.apache.cxf:cxf-core MAVEN version =3.1.0, =1.11.0, =1.12.0, =1.2.18, =1.0.0, =3.13, =1.0.0, =2.2.1, =2.3.1, =2.2.1, =2.2.1, =2.2.4 and more Source cves: CVE-2016-6812 Source advisory: GHSA-VW2C-5WPH-V92R...

ai.mattmann.mnemosyne:cas-cli (>=1.11.0, <=1.13.8), ai.mattmann.mnemosyne:cas-crawler (>=1.11.0, <=1.13.8) +3170 more potentially affected by CVE-2009-1190 via org.springframework:spring-core (>=1.2, <=2.5.6)

org.springframework:spring-core MAVEN version =1.2, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =0.3, =0.4 and more Source cves: CVE-2009-1190 Source advisory: GHSA-WJJR-H4WH-W6VV...