9.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41571

CVE-2026-41571: Note Mark: OIDC-registered users authenticated by submitting password "null"

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.19.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41571

CVE-2026-41571:

9.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/enchant97/note-mark/backend	go	< 0.0.0-20260417132909-dea5530cc989	0.0.0-20260417132909-dea5530cc989

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the IsPasswordMatch function located in backend/db/models.go. The function is designed to handle password verification, but it has a flaw when dealing with users who do not have a password stored, such as those created through an OIDC flow. In such cases, the function defaults to comparing the input password against a pre-computed hash of the string "null". This allows an attacker to gain unauthorized access to any OIDC user's account by simply providing "null" as the password during the login process. The provided patch confirms this by adding a condition to fail the authentication if the user's password field is empty, thus closing the security loophole. The function User.IsPasswordMatch would be the primary indicator in a runtime profile during an exploit of this vulnerability.

Vulnerable functions

User.IsPasswordMatch

backend/db/models.go

The function `IsPasswordMatch` is vulnerable because it compares the provided password with a hardcoded value 'null' when the user has no password set (e.g., OIDC-registered users). This allows an attacker to authenticate as any OIDC user by providing 'null' as the password. The patch fixes this by explicitly checking if a password is set for the user.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.