CVE-2026-100635
SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
- State
- Published
- Severity
- 8.2 High
- Published
- Sep 26, 2026
- Updated
- Oct 27, 2026
- Reserved
- Sep 26, 2026
Description
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-319 Cleartext Transmission of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
siyuansiyuan-note |
|
References
- GitHub Security Advisory (GHSA-7j37-4gq6-wm7m)vendor-advisory
- Patch Commitpatch
- Patch Commitpatch
- VulnCheck Advisory: SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookiethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.