HIGH 8.2 NVD
CVE-2026-100635
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attribut
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.
References
- https://github.com/siyuan-note/siyuan/commit/79d47867b106467c951475a9193455b48d1f3682
- https://github.com/siyuan-note/siyuan/commit/ff4d215f78a8d6e6db6052be18b5f9f4db9c7d68
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m
- https://www.vulncheck.com/advisories/siyuan-before-3.8.4-authentication-bypass-via-plainte
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-09-26 via NVD.
vulnfeed aggregates 11675 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.