Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.

Affected: Go: github.com/enchant97/note-mark/backend

## Summary

`IsPasswordMatch` in `backend/db/models.go` falls back to a hard-coded `bcrypt("null")` placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits `password: "null"` to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction.

## Details

`backend/db/models.go:36` defines the placeholder hash used by the timing-attack mitigation inside `IsPasswordMatch`:

```go var nullPasswordHash, _ = bcrypt.GenerateFromPassword([]byte("null"), bcrypt.DefaultCost) ```

`IsPasswordMatch` (`backend/db/models.go:46-58`) substitutes that placeholder when the stored password is empty:

```go func (u *User) IsPasswordMatch(plainPassword string) bool { var current []byte if len(u.Password) == 0 { // prevent CWE-208 current = nullPasswordHash } else { current = u.Password } if err := bcrypt.CompareHashAndPassword(current, []byte(plainPassword)); err == nil { return true } return false } ```

OIDC-registered users are stored with an empty password at `backend/services/auth.go:102-115`:

```go return db.DB.Transaction(func(tx *gorm.DB) error { user := db.User{ Username: username, Password: []byte(""), } // ... }) ```

The internal login endpoint (`POST /api/auth/token`, handled at `backend/services/auth.go:20-54`) calls `IsPasswordMatch` with the caller-su…