CVE-2026-126265: SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie
SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator session.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
SiYuan versions from 2.1.0 before 3.8.9 are affected. The issue is in the loginAuth CAPTCHA challenge handling.
What does an attacker need to exploit this issue?
An attacker needs a previously issued signed siyuan cookie containing a solved CAPTCHA challenge. They can replay that cookie while submitting different incorrect access codes to brute-force the code.
Does exploitation require an existing account or user interaction?
No existing account or user interaction is indicated. The vulnerability is rated with no privileges required and no user interaction required.
What is the likely impact of successful exploitation?
Successful brute-forcing can give the attacker an administrator session. The supplied severity vector indicates high confidentiality and integrity impact, with no availability impact.