CVE-2026-41571

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41571", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-21T14:15:21.957Z", "datePublished": "2026-05-04T17:42:32.428Z", "dateUpdated": "2026-05-04T20:20:53.632Z"}, "containers": {"cna": {"title": "Note Mark: OIDC-registered users authenticated by submitting password \"null\"", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh"}, {"name": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3"}], "affected": [{"vendor": "enchant97", "product": "note-mark", "versions": [{"version": "= 0.19.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T17:42:32.428Z"}, "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt(\"null\") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: \"null\" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3."}], "source": {"advisory": "GHSA-pxf8-6wqm-r6hh", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-04T20:20:49.852480Z", "id": "CVE-2026-41571", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T20:20:53.632Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41571", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-04T20:20:49.852480Z"}}}], "references": [{"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T20:20:41.523Z"}}], "cna": {"title": "Note Mark: OIDC-registered users authenticated by submitting password \"null\"", "source": {"advisory": "GHSA-pxf8-6wqm-r6hh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "enchant97", "product": "note-mark", "versions": [{"status": "affected", "version": "= 0.19.2"}]}], "references": [{"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh", "name": "https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3", "name": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt(\"null\") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: \"null\" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T17:42:32.428Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41571", "state": "PUBLISHED", "dateUpdated": "2026-05-04T20:20:53.632Z", "dateReserved": "2026-04-21T14:15:21.957Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-04T17:42:32.428Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "note-mark", "vendor": "enchant97", "versions": [{"status": "affected", "version": "= 0.19.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt(\"null\") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: \"null\" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3."}, {"lang": "es", "value": "Note Mark es una aplicaci\u00f3n de c\u00f3digo abierto para tomar notas. En la versi\u00f3n 0.19.2, IsPasswordMatch en backend/db/models.go recurre a un marcador de posici\u00f3n bcrypt(\u2019null\u2019) codificado siempre que un usuario no tiene una contrase\u00f1a almacenada. Los usuarios registrados con OIDC se crean con una contrase\u00f1a vac\u00eda, por lo que cualquiera que env\u00ede password: \u2019null\u2019 al endpoint de inicio de sesi\u00f3n interno recibe una sesi\u00f3n v\u00e1lida para ese usuario. La omisi\u00f3n no est\u00e1 autenticada y no requiere interacci\u00f3n del usuario. Este problema ha sido parcheado en la versi\u00f3n 0.19.3."}], "id": "CVE-2026-41571", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41571", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-04T20:20:49.852480Z", "version": "2.0.3"}}]}, "published": "2026-05-04T18:16:29.600", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-pxf8-6wqm-r6hh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.19.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "note-mark", "source": "cna", "vendor": "enchant97"}, "product": "note-mark", "vendor": "enchant97"}], "created": "2026-05-04T19:30:02.480396+00:00", "updated": "2026-05-04T19:30:02.684803+00:00", "vendors": ["enchant97", "enchant97$PRODUCT$note-mark"]}