CVE-2026-100635 json
SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
published 2026-09-26 44 d ago modified 2026-10-27 13 d ago also EUVD-2026-87729
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.
Patch / fix
- siyuan-note siyuan 3.8.4
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 41 d ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- siyuan-note siyuan
Classification
- Weakness
-
- CWE-319 Cleartext Transmission of Sensitive Information
References
-
github.com
/siyuan-note/siyuan/commit/79d47867b106467c951475a9193455b48d1f3682
patch
-
github.com
/siyuan-note/siyuan/commit/ff4d215f78a8d6e6db6052be18b5f9f4db9c7d68
patch
-
github.com
/siyuan-note/siyuan/security/advisories/GHSA-7j37-4gq6-wm7m
vendor-advisory, exploit
-
vulncheck.com
/advisories/siyuan-before-3.8.4-authentication-bypass-via-plaintext-session-cookie
third-party-advisory
Sources
- CVE List CVE-2026-100635
- NVD CVE-2026-100635
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.