CVE-2026-100635CWE-319

CVE-2026-100635

Medium · published September 26, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00259 · 16.6th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-09-26T18:16Z
References (5)
https://github.com/siyuan-note/siyuan/commit/79d47867b106467c951475a9193455b48d1f3682 · [email protected]https://github.com/siyuan-note/siyuan/commit/ff4d215f78a8d6e6db6052be18b5f9f4db9c7d68 · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m · [email protected]https://www.vulncheck.com/advisories/siyuan-before-3.8.4-authentication-bypass-via-plaintext-session-cookie · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 26 SEP 13:23Z
    SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
    cvelistv5