PT-2026-146596

CVE-2026-126265

Published

2026-11-13

Updated

2026-11-14

Description by

CVSS 4.0

9.1

Critical

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SiYuan versions 2.1.0 through 3.8.8

Description A flaw exists where the CAPTCHA challenge for the loginAuth process is stored in a signed client-side cookie. This allows an attacker to reuse a previously solved challenge by replaying the signed siyuan cookie while submitting different incorrect access codes. By doing so, they can brute-force the access code to obtain an administrator session.

Recommendations Update to version 3.8.9.

Exploitability

Exploit

Fix

Impacts

Researchers

Rexpository

Vendors

Affected products

Weakness enumeration

CWE-307: Improper Restriction of Excessive Authentication Attempts

Related identifiers