Skip to content
Threat Feed

Product

Note-Mark

1 brief RSS
critical advisory

Note Mark OIDC Authentication Bypass via Hardcoded Password

A critical authentication bypass vulnerability in note-mark allows attackers to authenticate as any OIDC-registered user by submitting the password 'null' to the internal login endpoint due to a hardcoded bcrypt hash fallback, potentially leading to account takeover and persistent access.

note-mark authentication-bypass credential-access ghsa
2r 1t