Medium severity · published Sep 26, 2026
CVE-2026-100635
SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.8.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100635
vendor-advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m
patch
https://github.com/siyuan-note/siyuan/commit/79d47867b106467c951475a9193455b48d1f3682
patch
https://github.com/siyuan-note/siyuan/commit/ff4d215f78a8d6e6db6052be18b5f9f4db9c7d68
third-party-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-authentication-bypass-via-plaintext-session-cookie
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP