Security Advisory

CVE-2026-41571

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-04 17:42:32

Last updated 2026-05-04 20:20:53

Assigner GitHub_M

CVSS score 9.4

State PUBLISHED

Description

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.

← Browse all CVEs View on cve.org ↗