SiYuan CVE-2026-73054
HIGHSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated bypass (AV:N/PR:N/AC:L/UI:N); impact confined to confidentiality with no integrity or availability effect, scope unchanged.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.
AnalysisAI
Authentication bypass in SiYuan's WebSocket endpoint allows unauthenticated remote attackers to access the live kernel event stream - including document identifiers, titles, and operation logs - in all versions before v3.7.4. The flaw stems from a query-parameter parsing differential between two distinct security checks: the auth-exemption path and the session quarantine path resolve duplicate query parameters differently, allowing a crafted URI to satisfy the exemption check while evading token validation entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability requires network reachability to the SiYuan WebSocket endpoint - by default port 6806. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is exploitable remotely by any unauthenticated attacker with network access, with no attack complexity or special conditions required - a worst-case access profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who identifies an internet-exposed SiYuan instance sends a crafted WebSocket upgrade request to the kernel endpoint with a duplicated 'token' query parameter - one value satisfying the exemption check, one bypassing token validation - causing the server to accept the unauthenticated connection. Once connected, the attacker passively receives the live kernel event stream, harvesting document identifiers, titles, and operation logs in real time without any user interaction. … |
| Remediation | Upgrade SiYuan to version v3.7.4 or later, which resolves the query parameter parsing differential per the vendor security advisory at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8w8-3pqp-wr83. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all SiYuan deployments and determine internet exposure status and current version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today