CVE-2026-41571
Critical
Description
Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.
SeverityCritical
CVSS9.4
Exploit probability—
ProductGithub.com/enchant97/note-mark/backend
PublishedMay 4, 2026
First seenMay 4, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- github.com/enchant97/note-mark/backend0.0.0-20260417132909-dea5530cc989 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/enchant97/note-mark/backendGo | v < 0.0.0-20260417132909-dea5530cc989 | 0.0.0-20260417132909-dea5530cc989 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.