CVE-2026-41571

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.

• CWE-287

• https://github.com/enchant97/note-mark/releases/tag/v0.19.3
• https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh
• https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh

Published

May 4, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41566Improper Handling of Insufficient Permissions or Privileges …9.4
• CVE-2026-41567Moby is an open source container framework. In versions prio…7.2
• CVE-2026-41568Moby is an open source container framework. In Docker Engine…6.1
• CVE-2026-41569authentik is an open-source identity provider. Prior to vers…6.1
• CVE-2026-4157ChargePoint Home Flex revssh Service Command Injection Remot…7.5
• CVE-2026-41570PHPUnit is a testing framework for PHP. In versions 12.5.21 …7.8
• CVE-2026-41572Note Mark is an open-source note-taking application. Prior t…5.3
• CVE-2026-41574Nhost is an open source Firebase alternative with GraphQL. P…9.8
• CVE-2026-41575In th30d4y/IP from version 1.0.1 to before version 2.0.1, a …6.1
• CVE-2026-41576Brave CMS is an open-source CMS. Prior to commit 6c56603, th…7.1
• CVE-2026-41577authentik is an open-source identity provider. Prior to vers…7.5
• CVE-2026-41579runc is a CLI tool for spawning and running containers accor…3.3