CVE-2026-73046

Received Received - Intake

SiYuan Authentication Bypass via Brute Force

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulnCheck

Description

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-73046

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

SiYuan before v3.7.4 has a flaw in its authentication system. The CheckAuth() middleware fails to restrict excessive login attempts for HTTP Basic Authentication. Attackers can bypass CAPTCHA or lockout protections and brute-force the admin access code to gain full administrative access.

Impact Analysis

An unauthenticated remote attacker could exploit this to gain full control over a SiYuan instance, accessing sensitive data or performing unauthorized actions. The lack of rate limiting allows automated attacks to succeed quickly.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR or HIPAA requirements for data protection and access controls. Full administrative access may result in data breaches or non-compliance.

Mitigation Strategies

Upgrade SiYuan to version v3.7.4 or later to address the improper authentication restriction in the CheckAuth() middleware.

Hi! I’m here to help you understand CVE-2026-73046. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70