SiYuan up to 3.5.1 hard-coded key

Summaryinfo

A vulnerability classified as problematic was found in SiYuan up to 3.5.1. Affected by this vulnerability is an unknown functionality. Such manipulation leads to hard-coded key. This vulnerability is uniquely identified as CVE-2025-68948. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in SiYuan up to 3.5.1. Affected by this issue is an unknown function. The manipulation with an unknown input leads to a hard-coded key vulnerability. Using CWE to declare the problem leads to CWE-321. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. Impacted is confidentiality. CVE summarizes:

SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode is stored within the session cookie, an attacker who intercepts or obtains a user's encrypted session cookie (e.g., via session hijacking) can locally decrypt it using the public key. Once decrypted, the attacker can retrieve the AccessAuthCode in plain text and use it to authenticate or take over the session.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-68948 since 12/26/2025. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.001.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-205463). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• SiYuan

Version

• 3.5.0
• 3.5.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion