Skip to content
OpenAdvisories

Package · Go

github.com/enchant97/note-mark/backend

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-44523

    Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

    Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte.…

    enchant97 note-mark github.com/enchant97/note-mark/backend Go
  • Critical 9.4
    CVE-2026-41571

    Note Mark: OIDC-registered users authenticated by submitting password "null"

    Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty passw…

    enchant97 note-mark github.com/enchant97/note-mark/backend Go