Executive brief
SiYuan is a note-taking application with a publish service that allows users to share notes with others over the web. Before version 3.8.4, the application issued session cookies without proper security flags and over unencrypted HTTP, allowing an attacker positioned on the network path to capture and replay valid session tokens to access published content without knowing the account password.
Technical details
The vulnerability is a session fixation and cookie theft issue affecting the publish service authentication mechanism. Session cookies (publish-visitor-session-id) are issued without the Secure and SameSite attributes over plaintext HTTP connections, making them observable to an on-path attacker during Basic Auth exchanges. An attacker can intercept and replay these cookies to bypass authentication and access authenticated publish endpoints.
Affected products
- SiYuan SiYuan before 3.8.4
Timeline
- 2026-09-26: disclosed: CVE-2026-100635 published
- 2026-09-03: patched: Fix committed addressing session invalidation after password changes