{"id":"CVE-2026-41571","revision":"8a05c52be16e4be9b8ee06d1fdbfd583","records":[{"revision":"8a05c52be16e4be9b8ee06d1fdbfd583","observedAt":"2026-10-27T10:10:19.004+00:00","statement":{"source":"nvd","id":"CVE-2026-41571","aliases":[],"title":"Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt(\"null\") placeholder whenever a user has no stored password. OIDC-registered users are created …","description":"Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt(\"null\") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: \"null\" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.","state":0,"publishedAt":"2026-05-04T18:16:29.6+00:00","modifiedAt":"2026-10-26T19:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","score":9.4,"severity":"CRITICAL"}],"references":["https://github.com/enchant97/note-mark/releases/tag/v0.19.3","https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41571","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-287"],"productCriteria":[],"sourceDates":{"published":"2026-05-04T18:16:29.600","lastModified":"2026-10-26T19:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41571","identifiers":["CVE-2026-41571"]},"retained":false,"historicalAffected":[]}],"coverage":[]}