A critical authentication bypass vulnerability exists in note-mark backend versions prior to 0.0.0-20260417132909-dea5530cc989. The function IsPasswordMatch uses a hard-coded bcrypt hash of the string "null" as a fallback for users with empty passwords, which includes OIDC-registered users. An attacker can submit the password "null" to the internal login endpoint to gain unauthorized access to any OIDC-only user account without authentication. This allows reading and modifying the victim's data and setting a new password, effectively taking over the account. The vulnerability is present when internal login is enabled (default) alongside OIDC user creation. A patch is available that rejects login attempts for users with no stored password.