CVE-2026-126265 · Package
NO FIX YET · SEE WHAT TO DO
SiYuan stores the loginAuth CAPTCHA challenge in a signed client-side cookie, so a solved challenge can be reused. An attacker can replay the signed siyuan cookie with many wrong access codes to brute-force the code and obtain an administrator session.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
SiYuan instances from 2.1.0 before 3.8.9 that use access-code login are exposed, because the CAPTCHA check can be bypassed by replaying a cookie. Instances on 3.8.9 or later, or without access-code login, are not affected according to the sources.
Not affected if no-access-code-login, version-3.8.9-or-later
Who cares note-app, self-hosted, siyuan
3.8.9SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator session.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.