CVE-2026-41571
Note Mark: OIDC-registered users authenticated by submitting password "null"
CVSS Score
9.4
EPSS Score
0.0%
EPSS Percentile
0th
Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.
| CWE | CWE-287 |
| Vendor | enchant97 |
| Product | note-mark |
| Published | May 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for enchant97 note-mark
Be the first to know when new critical vulnerabilities affecting enchant97 note-mark are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
Affected Versions
enchant97 / note-mark
= 0.19.2