A critical authentication bypass vulnerability in Joplin Server allows unauthenticated attackers to gain full account access via brute-force attacks against the SSO login process.

The vulnerability exists in the GET /api/login_with_code/:id endpoint, which fails to implement brute-force protection for nine-digit SSO authentication codes. An unauthenticated attacker can exhaust the codes within their ten-minute lifetime to hijack user sessions.

Successful exploitation allows an attacker to obtain a full session token, granting them complete control over the victim's notes, notebooks, and account settings. Given the CVSS score of 9.1, this vulnerability poses a severe risk to data confidentiality and integrity, potentially leading to unauthorized disclosure of sensitive information stored within the application.

Immediate Action: Upgrade Joplin Server to version 3.7.2 or later to implement the necessary brute-force rate limiting on the SSO authentication endpoint.

Proactive Monitoring: Review server access logs for anomalous patterns of requests to the /api/login_with_code/ endpoint, specifically looking for high volumes of failed attempts originating from single or distributed IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or rate-limiting proxy in front of the Joplin Server instance to detect and block excessive requests to the login API.

Public Exploit Available: No

The severity of this vulnerability, combined with its direct impact on user account security, necessitates immediate action. Administrators should prioritize the update to version 3.7.2 across all production instances to close the authentication gap and prevent unauthorized access to sensitive user data.