SiYuan CVE-2026-100635

Requires ALL of: (1) SiYuan's publish service must be enabled and protected by Basic Auth; (2) the service must be served over plaintext HTTP rather than HTTPS/TLS, since the flaw is that session cookies lack Secure and SameSite attributes and travel in cleartext; (3) the attacker must hold an on-path/man-in-the-middle network position (AT:P) to observe the publish-visitor-session-id cookie during a legitimate Basic Auth exchange. LIMITING FACTORS: deploying the publish service behind TLS/HTTPS eliminates the cleartext exposure and effectively mitigates the attack; the attacker cannot exploit this remotely without network vantage between victim and server; the publish feature must be actively in use. No password knowledge or prior authentication by the attacker is needed once the cookie is captured (PR:N).

This is a genuine but conditionally-exploitable authentication bypass rather than a high-CVSS-low-real-risk item. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H) scores 8.2, but the AT:P (attack requirement: present) metric is the crux - successful attack requires an on-path/man-in-the-middle position to observe the plaintext cookie, which materially limits opportunistic exploitation. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so all three exploitation-probability signals point to no confirmed or widespread exploitation; the risk is targeted and network-position-dependent, not internet-wide. Confidentiality impact is real (VC:H - replay grants access to authenticated publish endpoints) while integrity/availability are unaffected (VI:N/VA:N). Note a signal tension: the vendor scores AC:L, but the requirement for an on-path position is better captured as elevated difficulty - my independent CVSS 3.1 assessment uses AC:H for that reason, lowering my computed base to ~5.9 versus the vendor's 8.2. The root cause (CWE-319 cleartext transmission - cookies without Secure/SameSite over HTTP) is fully corroborated by the patch commits, which add a CredentialVersion binding and session revocation on password change.

A victim runs SiYuan's publish service over plaintext HTTP on a shared or untrusted network. An attacker positioned on the path (e.g., same LAN, rogue Wi-Fi, or upstream hop) passively captures the publish-visitor-session-id cookie during a Basic Auth exchange and replays it against the authenticated publish endpoints, gaining access without ever learning the account password. No public exploit code is identified, but the technique is a standard session-replay and requires no custom tooling.