CVE-2026-41571CWE-287

Note Mark: OIDC-registered users authenticated by submitting password "null"

Critical · published May 4, 2026

CVSS v3.1
9.4
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00477 · 40.2th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-05-04T17:42Z
EPSS history
Timeline
  • 04 MAY 17:42Z
    Note Mark: OIDC-registered users authenticated by submitting password "null"
    cvelistv5