CVE-2026-73046 SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth
Attackers can brute-force the admin access code via HTTP Basic Auth to gain full administrator access to the SiYuan kernel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73046?
CVE-2026-73046 is a critical authentication bypass vulnerability in siyuan-note siyuan, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.
Weakness: CWE-307
Which versions are affected by CVE-2026-73046?
How do I fix CVE-2026-73046?
No fix has been published for CVE-2026-73046 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-73046 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73046 exists.
Sources
Also known as GHSA-84q8-8mw3-429h.