CVE-2026-73046 in SiYuan
Summary
by MITRE • 08/15/2026
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability in SiYuan before version 3.7.4 represents a critical authentication flaw that undermines the security of the entire application ecosystem. The CheckAuth() middleware serves as the primary gatekeeper for nearly all API endpoints within the /api/* surface, making this weakness particularly dangerous as it provides attackers with unrestricted access to administrative functions. The implementation fails to enforce any rate limiting or account lockout mechanisms when processing HTTP Basic Authentication requests, creating an environment where automated brute force attacks can proceed without restriction.
The technical flaw manifests in how the system handles workspace access codes during authentication. While the application correctly accepts the Conf.AccessAuthCode as the password component of Basic Authentication, it completely bypasses all security controls that would normally protect against credential stuffing or brute force attempts. This includes the CAPTCHA verification systems and failure counter mechanisms that are properly implemented for cookie-based session login paths. The absence of these protective measures means that attackers can submit unlimited authentication requests without facing any delays or account lockouts, effectively removing any barriers to unauthorized access.
The operational impact of this vulnerability is severe as it allows unauthenticated remote attackers to gain full administrator privileges over the SiYuan kernel. This level of access enables attackers to modify system configurations, access sensitive data, manipulate content, and potentially compromise the entire system. The ability to perform unlimited automated requests means that attackers can quickly exhaust all possible password combinations through brute force methods, making this attack vector particularly effective against weak or commonly used access codes. The vulnerability essentially removes any meaningful protection around the administrative interface.
The secondary weakness involving non-constant-time string comparison further amplifies the risk by potentially exposing timing information that could aid attackers in their brute force efforts. This type of vulnerability falls under CWE-1048, which addresses improper handling of authentication credentials, and aligns with ATT&CK technique T1110.003 for credential stuffing attacks. The combination of unlimited attempts and timing side channels creates an ideal environment for successful exploitation. Organizations using affected versions should immediately implement rate limiting controls at the network level while also applying the necessary code patches to address both the authentication bypass and the constant-time comparison issues.
The vulnerability demonstrates a fundamental flaw in the security architecture where different authentication paths are not consistently protected with the same security measures. This inconsistency creates an attack surface that attackers can exploit by choosing the least protected authentication method available. The failure to implement proper account lockout mechanisms, even for the most basic authentication checks, represents a significant gap in the application's defense-in-depth strategy and highlights the importance of applying consistent security controls across all authentication pathways within an application.