---
id: "GHSA-hg5w-8ppq-wpjq"
kind: "vulnerability"
aliases: ["GHSA-hg5w-8ppq-wpjq"]
title: "Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "withdrawn"
category: "package"
products: [{"name": "github.com/siyuan-note/siyuan/kernel", "fixed": [], "affected": "< 3.7.4", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-287", "go", "package", "self-hosted", "siyuan"]
not_affected_if: ["access-auth-code-unset", "version-3.7.4-or-later"]
published_at: "2026-08-16T00:31:28+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T21:45:38+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-hg5w-8ppq-wpjq", "first_seen_at": "2026-10-23T19:11:31+00:00"}]
---

# Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6

SiYuan's WebSocket endpoint parses duplicated query parameters differently in its auth-exemption check than in its session quarantine check, so an unauthenticated attacker can receive the live kernel event stream, including document IDs, titles and operation logs. This advisory is withdrawn as a duplicate of GHSA-c8w8-3pqp-wr83, which covers the same flaw.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/siyuan-note/siyuan/kernel affected < 3.7.4 fixed ?

## Fix

Upgrade SiYuan to v3.7.4 or later, or follow GHSA-c8w8-3pqp-wr83 which is the maintained advisory for this issue.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-hg5w-8ppq-wpjq

## From the sources

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-c8w8-3pqp-wr83. This link is maintained to preserve external references.

## Original Description
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_