Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100635SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie

Medium 5.9

In plain English

A medium-severity security flaw in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.3%top 74.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.8.4

Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-7j37-4gq6-wm7m) vendor-advisory
Patch Commit patch
Patch Commit patch
VulnCheck Advisory: SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie third-party-advisory