Description

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-26T14:16:45.007Z",
  "pubdate": "2026-09-26T14:16:45.007Z",
  "executiveSummary": "SiYuan versions prior to 3.8.4 are susceptible to an authentication bypass vulnerability located within the application's publish service.\nThe vulnerability arises from the improper configuration of session cookies, specifically the omission of the Secure and SameSite security attributes during transmission over plaintext HTTP connections.\nThis flaw allows an on-path adversary to intercept valid session identifiers (publish-visitor-session-id) transmitted during Basic Authentication exchanges.\nBy replaying these intercepted cookies, an unauthorized actor can impersonate a legitimate user and gain unrestricted access to protected publish endpoints without possessing valid credentials.\nThe risk is significant as it permits unauthorized access to sensitive application data and functions, potentially leading to full service compromise within the scope of the publish service.\nExploitation is feasible for any attacker capable of performing a man-in-the-middle attack or sniffing unencrypted network traffic on the local segment where the SiYuan instance operates.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of session management within the SiYuan publish service, specifically regarding the Set-Cookie HTTP response header. When the application issues a session identifier (publish-visitor-session-id), the implementation fails to enforce 'Secure' and 'SameSite' flags. The 'Secure' attribute is intended to ensure that cookies are only transmitted over encrypted (HTTPS) connections, while the 'SameSite' attribute provides protection against cross-site request forgery and cookie leakage.\nBecause the application does not enforce transport layer security (TLS) for cookie transmission, the publish-visitor-session-id is transmitted in cleartext during the Basic Auth handshake. An attacker positioned on the network path—such as an entity monitoring traffic on a shared or unencrypted local area network—can perform packet sniffing to capture the HTTP headers containing the session cookie.\nThe attack flow follows a predictable sequence: First, the attacker positions themselves as an on-path observer to capture traffic between a legitimate client and the SiYuan server. Second, the attacker monitors the plaintext HTTP exchanges associated with the publish service. Third, upon detecting a successful Basic Auth exchange, the attacker extracts the publish-visitor-session-id from the Set-Cookie header. Finally, the attacker injects this captured identifier into their own HTTP requests directed at the target publish endpoints.\nBecause the server relies solely on the presence of the publish-visitor-session-id for session validation and fails to verify the binding between the session and the initial authentication context, the server accepts the replayed cookie as legitimate. This grants the attacker immediate access to authenticated functionality. The vulnerability is present in all SiYuan versions prior to 3.8.4, which exposes both the session and the underlying user session state to hijacking. This exploit does not require the attacker to possess the victim's password, as the session token effectively replaces the requirement for credentials for the duration of the session lifecycle. The impact is a complete bypass of the authentication mechanism, allowing an attacker to act with the privileges of the hijacked session until the session expires or is invalidated by the server."
}