JWT bypass let anyone impersonate agent memory users

An unauthenticated attacker could forge a token for any user and read or overwrite that user's agent memory. GHSA-xcw4-53cc-hv32, published September 18, covers mnemosyne-memory through v3.10.0. The sync server took the JWT bearer token, base64-decoded it, and handed it to a JWT library with verification turned off.

That means anyone with network reach to the server could get in without a password or a valid session. Any well-formed token was accepted, including one using alg:none, per the GitHub Advisory. A token needed the right shape and whatever user_id the attacker wanted inside it. The server would decode it, trust it, and hand back that user's memory. The bug scores 9.1.

Agent memory is the accumulated context an agent builds up over time: task history, preferences, whatever it learned about the environment it runs in. Forge a token and you can read someone else's context or plant your own in it.

The fix in v3.10.1 swaps in a stdlib HS256 verifier that uses hmac.compare_digest for the signature check. It also enforces a strict alg check so a token can't downgrade itself to none, and validates exp against UTC-aware time.

Decode-not-verify is one of the oldest JWT mistakes there is. Library defaults are supposed to catch it by refusing to skip verification silently. The advisory doesn't say whether older major versions carry the same code path. Anyone running a pre-3.10.1 build should confirm their own version's fix status rather than assume.