CVE-2026-41571GHSA-PXF8-6WQM-R6HHGO-2026-5557
Note Mark: OIDC-registered users authenticated by submitting password "null"
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.0.0-20260417132909-dea5530cc989
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: poc
- Automatable: yes
- Technical impact: total
Summary
Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- enchant97 note-mark
0.19.2
- github.com/enchant97/note-mark/backendGo
fixed in 0.0.0-20260417132909-dea5530cc989