{"id":"CVE-2026-126265","kind":"vulnerability","aliases":["CVE-2026-126265"],"related":[],"title":"SiYuan: replayed CAPTCHA cookie allows brute-forcing login to admin session","description":"SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator session.","summary":"SiYuan stores the loginAuth CAPTCHA challenge in a signed client-side cookie, so a solved challenge can be reused. An attacker can replay the signed siyuan cookie with many wrong access codes to brute-force the code and obtain an administrator session.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["note-app","package","self-hosted","siyuan"],"not_affected_if":["no-access-code-login","version-3.8.9-or-later"],"how_to_check":"- Check the installed SiYuan version; affected versions are 2.1.0 before 3.8.9.\n- Check whether the access code login (loginAuth) is enabled on the instance.","fix":"- SiYuan: `3.8.9`","status":"open","published_at":"2026-11-13T10:17:29+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","triaged_at":"2026-11-13T10:48:41+00:00","updated_at":"2026-11-13T10:48:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:48:41Z","model":"claude-haiku-5-5","output":{"fix":"- SiYuan: `3.8.9`","reach":"network","title":"SiYuan: replayed CAPTCHA cookie allows brute-forcing login to admin session","impact":"high","summary":"SiYuan stores the loginAuth CAPTCHA challenge in a signed client-side cookie, so a solved challenge can be reused. An attacker can replay the signed siyuan cookie with many wrong access codes to brute-force the code and obtain an administrator session.","audience":"developers","category":"package","nicknames":[],"who_cares":["siyuan","self-hosted","note-app"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker gains administrator session on the SiYuan instance","analyst_note":"Confirm the exposed configuration (access code login enabled by default or not) at the vendor advisory on github.com and the vulncheck advisory.","how_to_check":"- Check the installed SiYuan version; affected versions are 2.1.0 before 3.8.9.\n- Check whether the access code login (loginAuth) is enabled on the instance.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-3.8.9-or-later","no-access-code-login"],"who_is_affected":"SiYuan instances from 2.1.0 before 3.8.9 that use access-code login are exposed, because the CAPTCHA check can be bypassed by replaying a cookie. Instances on 3.8.9 or later, or without access-code login, are not affected according to the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000742,"input_tokens":4622,"output_tokens":560,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126265':15A,18A '-2026':14A,17A '2.1.0':72C '3.8.9':74C 'access':58B,108C 'admin':11A 'administr':69B,119C 'allow':5A,91C 'app':21B 'attack':48B,97C 'brute':7A,62B,112C 'brute-forc':6A,61B,111C 'captcha':3A,31B,81C 'challeng':32B,43B,82C,96C 'client':37B,88C 'client-sid':36B,87C 'code':59B,65B,109C,115C 'contain':75C 'cooki':4A,39B,54B,90C,104C 'cve':13A,16A 'distinct':106C 'flaw':77C 'forc':8A,63B,113C 'gain':117C 'host':25B 'live':83C 'login':9A 'loginauth':30B,80C 'mani':56B 'note':20B 'note-app':19B 'obtain':67B 'origin':101C 'packag':22B 'replay':2A,50B,99C 'reus':46B,92C 'self':24B 'self-host':23B 'session':12A,70B,120C 'side':38B,89C 'sign':35B,52B,86C,102C 'siyuan':1A,26B,27B,53B,71C,103C 'solv':42B,95C 'store':28B 'wrong':57B,107C","nicknames":[],"mitigations":[],"who_affected":"SiYuan instances from 2.1.0 before 3.8.9 that use access-code login are exposed, because the CAPTCHA check can be bypassed by replaying a cookie. Instances on 3.8.9 or later, or without access-code login, are not affected according to the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","noteapp","package","selfhosted","siyuan"],"campaign_type":null,"search_a":"'-126265':15A,18A '-2026':14A,17A 'admin':11A 'allow':5A 'brute':7A 'brute-forc':6A 'captcha':3A 'cooki':4A 'cve':13A,16A 'forc':8A 'login':9A 'replay':2A 'session':12A 'siyuan':1A","search_b":"'access':58B 'administr':69B 'app':21B 'attack':48B 'brute':62B 'brute-forc':61B 'captcha':31B 'challeng':32B,43B 'client':37B 'client-sid':36B 'code':59B,65B 'cooki':39B,54B 'forc':63B 'host':25B 'loginauth':30B 'mani':56B 'note':20B 'note-app':19B 'obtain':67B 'packag':22B 'replay':50B 'reus':46B 'self':24B 'self-host':23B 'session':70B 'side':38B 'sign':35B,52B 'siyuan':26B,27B,53B 'solv':42B 'store':28B 'wrong':57B","search_c":"'2.1.0':72C '3.8.9':74C 'access':108C 'administr':119C 'allow':91C 'attack':97C 'brute':112C 'brute-forc':111C 'captcha':81C 'challeng':82C,96C 'client':88C 'client-sid':87C 'code':109C,115C 'contain':75C 'cooki':90C,104C 'distinct':106C 'flaw':77C 'forc':113C 'gain':117C 'live':83C 'loginauth':80C 'origin':101C 'replay':99C 'reus':92C 'session':120C 'side':89C 'sign':86C,102C 'siyuan':71C,103C 'solv':95C 'wrong':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T04:22:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126265","severity":null,"published_at":"2026-11-13T10:17:29+00:00","modified_at":"2026-11-13T10:17:29+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","fetched_at":"2026-11-13T10:47:12+00:00","note":null}],"documents":[{"id":144859,"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-23g4-vqq8-5764","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T04:22:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144860,"url":"https://www.vulncheck.com/advisories/siyuan-2.1.0-before-3.8.9-captcha-bypass-via-stale-login-cookie","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}