CVE-2026-41571: Note Mark: OIDC-registered users authenticated by submitting password "null"

April 25, 2026 (updated May 7, 2026)

IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction.

References

github.com/advisories/GHSA-pxf8-6wqm-r6hh
github.com/enchant97/note-mark/commit/dea5530cc9891187b51548ef9f2868b7dc9f4e92
github.com/enchant97/note-mark/releases/tag/v0.19.3
github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh
nvd.nist.gov/vuln/detail/CVE-2026-41571

Code Behaviors & Features

Detect and mitigate CVE-2026-41571 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →