CVE-2026-100635

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4

Description An authentication bypass exists in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie during a Basic Auth exchange and replay it to access authenticated publish endpoints without the account password.

Recommendations Update to version 3.8.4 or later.