PT-2026-71243 · Siyuan · Siyuan
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.7.4
Description
In publish mode, unauthenticated endpoints disclose encrypted-notebook key-derivation material and wrapped data keys. This allows attackers to retrieve the Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys. Consequently, this enables unlimited offline master-password cracking without rate limiting. Argon2id is a password hashing function designed to resist GPU-based cracking attacks.
Recommendations
Update to version 3.7.4 or later.
Exploit
Fix
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Siyuan