CVE-2026-41571: Note Mark authentication bypass through placeholder password check
Note Mark versions described as affected fall back to a fixed placeholder when comparing passwords for accounts without a stored password, including accounts created through OIDC. According to the record, this lets an unauthenticated party obtain a valid session without user interaction, and the GitHub-sourced CVSS score is 9.4. The record states the issue is fixed in version 0.19.3.
Overview
Note Mark is an open-source note-taking application. The record describes a flaw in the password-matching logic in backend/db/models.go: when a user has no stored password, the check falls back to a fixed placeholder. Accounts registered through OIDC are created with an empty password, which places them in this condition.
Impact
The record indicates that an unauthenticated party could obtain a valid session for affected user accounts without user interaction. The weakness is classified as CWE-287 (Improper Authentication). The GitHub-sourced CVSS score of 9.4 reflects a vector with network access, low complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact.
Affected products and versions
The description identifies version 0.19.2 as affected and version 0.19.3 as the patched release. The structured affected and fixes fields in the record are empty, so the full range of affected versions is not confirmed by the data available here.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS data in the record gives a probability of 0.00477 and a percentile of 0.3945.
Remediation and mitigation
- Upgrade Note Mark to version 0.19.3, as indicated on the project's release page.
- Review user accounts created through OIDC that have no stored password, and check for sessions that were not expected.
- After upgrading, consider invalidating existing sessions for accounts that may have been exposed, as an inference from the nature of the flaw.
- Limit network exposure of the login endpoint of unpatched instances until the update is applied.
Detection guidance
- Review authentication logs for successful logins to accounts that have no password set, especially from unfamiliar sources.
- Look for session creation events that are not preceded by a normal credential exchange.
- Correlate new sessions with OIDC account creation events to spot unusual patterns.
Limitations of the available information
The record does not include a detailed technical analysis from the vendor, the exact affected version range, or confirmation of whether earlier versions are impacted. The title field is missing from the source record. Deployment-specific configurations that could change exposure are unknown.
Frequently asked questions
Which Note Mark version is fixed?
The record states the issue is patched in version 0.19.3, and it identifies version 0.19.2 as affected.
Is this vulnerability known to be exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Which accounts are described as affected?
According to the description, accounts registered through OIDC are created with an empty password and are the case described in the record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.