CVE-2026-100635: SiYuan Auth Bypass Vulnerability

CVE-2026-100635 Overview

CVE-2026-100635 is an authentication bypass vulnerability affecting SiYuan versions prior to v3.8.4. The publish service issues publish-visitor-session-id cookies without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker who observes the Basic Auth exchange can capture the session cookie and replay it to reach authenticated publish endpoints. The attacker gains access without knowing the account password. The weakness is categorized as cleartext transmission of sensitive information [CWE-319].

Critical Impact

Network-adjacent attackers who intercept HTTP traffic can replay a valid session cookie to access authenticated SiYuan publish endpoints without credentials.

Affected Products

• SiYuan note-taking application versions prior to v3.8.4
• SiYuan publish service component (kernel/server/proxy/publish.go)
• Deployments exposing the publish proxy over plaintext HTTP

Discovery Timeline

• 2026-09-26 - CVE-2026-100635 published to the National Vulnerability Database
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100635

Vulnerability Analysis

The SiYuan publish service authenticates visitors using Basic Auth and then issues a publish-visitor-session-id cookie to track the session. On plaintext HTTP deployments the cookie travels in the clear and lacks the Secure and SameSite attributes. Any attacker positioned between the visitor and the server can read the cookie value from a single request. The attacker then supplies that cookie value in subsequent requests and is treated as the authenticated user. No password or secondary factor is required to complete the replay.

The pre-patch session model also lacked a credential version identifier. Sessions remained valid even after the account password changed, extending the window during which a captured cookie could be reused.

Root Cause

The root cause is cleartext transmission of a session identifier together with weak cookie attributes. The PublishSession struct bound a session only to a username and last-active timestamp, with no cryptographic rotation tied to credential changes. The proxy accepted any valid session ID without re-verifying the backing account state on each request.

Attack Vector

Exploitation requires network adjacency sufficient to observe traffic between a visitor and the SiYuan publish service. Public Wi-Fi, compromised routers, and shared LAN segments all satisfy this condition. The attacker records a Basic Auth exchange, extracts the publish-visitor-session-id cookie, and submits it to protected publish endpoints to retrieve content.

// Patch excerpt - kernel/model/auth.go
// Introduces CredentialVersion to invalidate sessions after password changes
type Account struct {
    Username          string
    Password          string
    Token             string
    CredentialVersion string
}

// PublishSession records the owning username, credential version, and last active time.
type PublishSession struct {
    Username          string
    CredentialVersion string
    LastActive        time.Time
}

Source: GitHub Commit 79d4786

// Patch excerpt - kernel/server/proxy/publish.go
// Lookup now returns the full account bound to the session in a single call,
// ensuring stale accounts cannot be resolved via a replayed session ID.
if cookieErr == nil {
    sessionID := sessionIdCookie.Value
    if account := model.GetBasicAuthAccountBySessionID(sessionID); account != nil {
        request.Header.Set(model.XAuthTokenKey, account.Token)
        response, err = publishRoundTripper.RoundTrip(request)
        return
    }
}

Source: GitHub Commit 79d4786

Detection Methods for CVE-2026-100635

Indicators of Compromise

• Duplicate use of the same publish-visitor-session-id cookie value from distinct source IP addresses or user agents.
• Access to publish endpoints from IPs that never completed a prior Basic Auth exchange.
• Unexpected successful requests to the publish proxy occurring after a password change event.

Detection Strategies

• Inspect reverse-proxy and server access logs for publish-visitor-session-id cookie reuse across unrelated clients.
• Correlate Basic Auth success events with the originating IP and alert on later session ID use from a different IP.
• Flag SiYuan publish traffic traversing cleartext HTTP by matching on port 80 or missing TLS metadata.

Monitoring Recommendations

• Enable verbose HTTP logging on any reverse proxy fronting SiYuan and retain cookie identifiers for session-reuse analysis.
• Monitor for the SiYuan version banner and alert when any deployment reports a release older than v3.8.4.
• Track outbound Basic Auth headers on internal network segments to identify services still negotiating credentials in cleartext.

How to Mitigate CVE-2026-100635

Immediate Actions Required

• Upgrade SiYuan to v3.8.4 or later to apply the cookie-based auth and session invalidation fixes.
• Terminate TLS in front of the SiYuan publish service and redirect all plaintext HTTP traffic to HTTPS.
• Rotate account passwords on upgraded instances to force re-issuance of session cookies bound to the new credential version.

Patch Information

Upstream fixes are tracked in GHSA-7j37-4gq6-wm7m and delivered through commits 79d4786 and ff4d215. The patches introduce cookie-based authentication in the publish proxy and tie sessions to a CredentialVersion so password changes invalidate active sessions. See the VulnCheck advisory for additional context.

Workarounds

• Place SiYuan behind a reverse proxy (for example, Nginx or Caddy) that enforces HTTPS and sets Secure and SameSite=Strict on forwarded cookies.
• Restrict publish service access to trusted networks or a VPN until the upgrade can be deployed.
• Disable the publish service entirely if it is not required for the deployment.

# Nginx reverse-proxy snippet enforcing TLS and hardened cookie attributes
server {
    listen 443 ssl http2;
    server_name siyuan.example.com;

    ssl_certificate     /etc/ssl/certs/siyuan.crt;
    ssl_certificate_key /etc/ssl/private/siyuan.key;

    location / {
        proxy_pass http://127.0.0.1:6806;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_cookie_flags publish-visitor-session-id secure samesite=strict httponly;
    }
}

server {
    listen 80;
    server_name siyuan.example.com;
    return 301 https://$host$request_uri;
}