CVE-2026-100635: SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments using the SiYuan publish service over plaintext HTTP are exposed, particularly where an attacker can observe traffic between a user and the service. The issue affects versions before v3.8.4.
What does an attacker need to exploit it?
An attacker must be able to act on-path and observe a Basic Auth exchange over plaintext HTTP. They can capture the valid publish-visitor-session-id cookie and replay it to authenticated publish endpoints without the account password.
Does the issue affect HTTPS-only deployments?
The provided information identifies session cookies issued over plaintext HTTP connections as the exposure condition. It does not indicate that an attacker can capture and replay the cookie from an HTTPS-protected exchange.
What can be done if upgrading is not immediately possible?
Avoid serving the publish service over plaintext HTTP, since the described attack depends on observing HTTP traffic. Restrict access to trusted networks where possible until the deployment can be upgraded to v3.8.4 or later.