Description

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T22:16:54.600Z",
  "pubdate": "2026-08-15T22:16:54.600Z",
  "executiveSummary": "An improper restriction of excessive authentication attempts exists in SiYuan before v3.7.4. The vulnerability affects the HTTP Basic Authentication branch within the CheckAuth() middleware, which protects the /api/* surface. The flaw allows unauthenticated remote attackers to perform unlimited automated brute-force attacks against the workspace access code (Conf.AccessAuthCode) without triggering CAPTCHA or lockout mechanisms, and also utilizes a non-constant-time string comparison. Successful exploitation grants attackers full RoleAdministrator access to the SiYuan kernel, posing a critical risk to data confidentiality, integrity, and availability.",
  "technicalDetails": "The vulnerability resides in the CheckAuth() middleware of SiYuan prior to version 3.7.4. Specifically, the HTTP Basic Authentication branch responsible for guarding nearly the entire /api/* endpoint surface fails to properly enforce rate limiting and brute-force protections.\nDuring the authentication process, the middleware accepts the workspace access code (Conf.AccessAuthCode) as the HTTP Basic Authentication password. However, unlike the standard cookie and session login paths, this branch never consults the CAPTCHA or lockout gate, nor does it increment the failure counter tracking failed authentication attempts.\nConsequently, unauthenticated remote attackers can dispatch unlimited automated HTTP requests containing sequential or dictionary-based password guesses against the authentication interface. Additionally, a secondary weakness exacerbates the cryptographic posture: the supplied access code is evaluated using a standard non-constant-time string comparison, potentially introducing timing side-channel vectors.\nThe step-by-step attack flow proceeds as follows: 1) An unauthenticated remote attacker targets the exposed /api/* endpoints protected by HTTP Basic Authentication. 2) The attacker transmits high-frequency automated HTTP requests containing candidate strings in the password field. 3) The CheckAuth() middleware processes each request against Conf.AccessAuthCode using a non-constant-time comparison without validating against a lockout gate or incrementing failure metrics. 4) Upon guessing the correct access code, the system authenticates the request, granting the attacker full RoleAdministrator privileges to the underlying SiYuan kernel."
}