https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T19:48:53.129963+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41571 CVE-2026-41571 — Note Mark: OIDC-registered users authenticated by submitting password "null" 2026-10-12T19:48:53.131033+00:00

Affected: enchant97 note-mark

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.