The vulnerability resides in the password validation logic of Note Mark 0.19.2, where IsPasswordMatch falls back to a hard‑coded bcrypt hash of the string "null" when a user record has no stored password. Because OIDC‑registered accounts are created with an empty password, any attacker who submits the password string "null" to the internal login endpoint can obtain a valid authenticated session. The bypass is anonymous, requires no user interaction, and effectively grants an attacker unauthorized access to an OIDC user’s private notes. This is a severe authentication bypass consistent with CWE‑287.

The affected product is enchant97:note‑mark version 0.19.2. The issue was fixed in version 0.19.3. Only installations of 0.19.2 that support OIDC registration are impacted.

The CVSS score of 9.4 reflects a critical level of severity. Although an EPSS score is not available, the vulnerability is entirely exploitable without any prerequisites beyond the ability to reach the internal login endpoint. It is not listed in the CISA KEV catalog, but its high severity and the fact that the poach requires no user interaction make it a high‑risk issue for any environment exposing Note Mark to the internet or an internal network. An attacker can obtain unauthorized access to any OIDC‑registered user’s data, leading to confidentiality compromise.