CVE-2026-100635
SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.
| CWE | CWE-319 |
| Vendor | siyuan-note |
| Product | siyuan |
| Published | Sep 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for siyuan-note siyuan
Be the first to know when new medium vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
siyuan-note / siyuan
0 < 3.8.4
References
github.com: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m github.com: https://github.com/siyuan-note/siyuan/commit/79d47867b106467c951475a9193455b48d1f3682 github.com: https://github.com/siyuan-note/siyuan/commit/ff4d215f78a8d6e6db6052be18b5f9f4db9c7d68 vulncheck.com: https://www.vulncheck.com/advisories/siyuan-before-3.8.4-authentication-bypass-via-plaintext-session-cookie
Credits
🔍 rexpository