Back to CVE List

CVE-2026-41571

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score
9.4 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Vulnerability Description

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.

Vulnerability Details

Published Date
Last Modified
CWE ID
CWE-287
Source
GitHub
Vendor
go
Product
github.com/enchant97/note-mark/backend

External References

Discussion (0)

Add Comment

No comments yet. Be the first!